STATE NUCLEAR REGULATORY INSPECTORATE OF UKRAINE

2011

STATE NUCLEAR REGULATORY INSPECTORATE OF UKRAINENATIONAL REPORT ON STRESS TEST RESULTSABBREVIATIONS
AC
AEFS
BDBA
BRU-A
BRU-K
C(I)SIP
ChNPP
CP
CPS
DBA
DC
DCH
DG
DSF
ECCS
ECR
EDG
EFS
ENSREG
EOP
FCP
FSS
HPIS
ISF
ISF-1
ISF-2
KhNPP
LOCA
LPIS
MCCI
MCP
MCR
MDGPU
MDGS
MGV
MSB
MSIV
NF
NNEGC
Energoatom
NPP
NPP
PGA
PRZ PORV
PSA
PSS
RCS
RF
RNPP
RPV
RV
SAMG

Alternating Current
Additional Emergency Feedwater System
Beyond Design Basis Accident
Steam Dump Valve to Atmosphere
Steam Dump Valve to Condenser
Comprehensive (Integrated) Safety Improvement Program for
Ukrainian NPPs
Chornobyl Nuclear Power Plant
Cooling Pool
Control and Protection System
Design Basis Accident
Direct Current
Direct Containment Heating
Diesel Generator
Dry Spent Fuel Storage Facility (Zaporizhzhya NPP)
Emergency Core Cooling System
Emergency Control Room
Emergency Diesel Generator
Emergency Feedwater System
European Nuclear Safety Regulators Group
Emergency Operating Procedure
Fuel Channel Cooling Pool
Full-Scope Simulator
High-Pressure Injection System
Interim Spent Fuel Storage Facility (Chornobyl NPP)
Wet Interim Spent Nuclear Fuel Storage Facility
Dry Interim Spent Nuclear Fuel Storage Facility
Khmelnitsky Nuclear Power Plant
Loss-of-Coolant Accident
Low-Pressure Injection System
Molten Corium/Concrete Interaction
Main Coolant Pump
Main Control Room
Mobile Diesel Generator and Pumping Unit
Mobile Diesel Generator Station
Main Gate Valve
Multi-Assembly Sealed Basket
Main Steam Isolation Valve
Nuclear Facility
National Nuclear Energy Generating Company Energoatom
Nuclear Power Plant
Nuclear Power Plant
Peak Ground Acceleration
Pressurizer Pilot-Operated Relief Valve
Probabilistic Safety Assessment
Plant Shift Supervisor
Reactor Coolant System
Reactor Facility
Rivne Nuclear Power Plant
Reactor Pressure Vessel
Relief Valve
Severe Accident Management Guideline
1STATE NUCLEAR REGULATORY INSPECTORATE OF UKRAINENATIONAL REPORT ON STRESS TEST RESULTS

SAR
SEWM
SFA
SFAP
SFP
SFPU
SG
SG SV
SLP
SNRIU
SSC
SUNPP
SV
SVO
TBSC
WWER
ZNPP

Safety Analysis Report
Site Emergency Work Manager
Spent Fuel Assembly
Spent Fuel Assembly Cooling Pool
Spent Fuel Pool
State Fire Protection Unit
Steam Generator
Steam Generator Safety Valve
Sequential Loading Program
State Nuclear Regulatory Inspectorate of Ukraine
Structures, Systems and Components
South Ukraine Nuclear Power Plant
Safety Valve
Active Water Treatment System
Transfer Basket Storage Compartment
Water-Cooled Water-Moderated Power Reactor
Zaporizhzhya Nuclear Power Plant

2

STATE NUCLEAR REGULATORY INSPECTORATE OF UKRAINENATIONAL REPORT ON STRESS TEST RESULTS

INTRODUCTION
On 11 March 2011, the Fukushima-1 NPP (Japan) suffered a severe accident caused byan earthquake and subsequent tsunami. The Fukushima-1 event exposed the nuclear
community to the following tasks: carry out a detailed analysis of the accident causes andlessons learned, develop and implement measures to prevent the severe accident andmitigate its adverse impact on the public and environment.
On 25 March 2011, the European Council declared that the safety of the European NPPs
should be reviewed on the basis of a comprehensive and transparent risk assessment(stress tests). At the Fifth Review Meeting of the Convention on Nuclear Safety (4–14 April
2001), the Contracting Parties pointed out the need for NPP safety reassessment andimmediate additional measures on NPP safety improvement, in their joint statement on the
Fukushima Daiichi accident.
On 13 May 2011, the European Nuclear Safety Regulators Group (ENSREG) and theEuropean Commission agreed technical requirements for stress tests for the European NPPs
(Declaration by ENSREG, Annex 1: EU stress test specifications). Pursuant to the ENSREG
technical requirements, stress test is a targeted reassessment of the safety margins of
nuclear power plants in the light of the events which occurred at Fukushima-1. The stresstests shall include a detailed analysis of extreme natural events and their combinations thatchallenge the plant safety functions and may cause a severe accident.
The safety improvement of Ukrainian NPPs in the light of the Fukushima-1 accident was
discussed at the meeting of the National Security and Defense Council of Ukraine (NSDC)
on 8 April 2011. The NSDC decision, which emphasizes the need for in-depth safety
reassessment of Ukrainian NPPs, including seismic analyses, was endorsed by Presidential
Decree No. 585/2011 of 12 May 2011.
The SNRIU Board approved an action plan for a targeted safety reassessment and further
safety improvement of Ukrainian NPPs in the light of the Fukushima-1 accident and an action
plan for a targeted safety reassessment and further safety improvement of Chornobyl NPP
units 1-3 and Interim Spent Fuel Storage Facility (ISF-1) in the light of the Fukushima-1
accident on 19 May and 5 July, respectively. One of the actions defined in the Action Plans
was a targeted safety reassessment of operating nuclear facilities at NPP sites (stress tests).
The Action Plans also provide for the following:− targeted review of emergency preparedness;− review and amendment (based on stress tests results) of the Comprehensive(Integrated) Safety Improvement Program for Ukrainian NPPs;− updating of the Plan for Safety Improvement of the Chornobyl NPP ISF-1;− analysis and improvement of the regulatory framework for nuclear and radiation
safety, strengthening of safety requirements for operating and new nuclear power
units.
The SNRIU developed the Recommendations on the Structure and Contents of theReport on Targeted Safety Reassessment of On-site Nuclear Facilities to Learn Lessons
from the Fukushima-1 Accident and introduced them by Order No. 91 of 23 June 2011. The
Recommendations are based on the ENSREG EU stress test specifications.
In the framework of the stress tests, the operators (NNEGC “Energoatom” and Chornobyl
NPP) analyzed in detail:− external extreme natural events (earthquakes, flooding, fires, tornadoes,
extremely high/low temperatures, extreme precipitations, strong winds,combinations of events);− loss of electrical power and/or loss of ultimate heat sink;− severe accident management.
At the operating nuclear power plants (Zaporizhzhya, Khmelnitsky, Rivne and South
Ukraine), the stress tests focused on nuclear fuel in the reactor cores, spent fuel pools, fresh
fuel rooms, dry spent nuclear fuel storage facility (Zaporizhzhya NPP).
3

STATE NUCLEAR REGULATORY INSPECTORATE OF UKRAINENATIONAL REPORT ON STRESS TEST RESULTS

At the Chornobyl NPP, the stress tests focused on spent nuclear fuel stored in the spent
fuel pools of units 1 and 2 and ISF-1. The spent fuel pool of unit 3 that may be used to store
spent nuclear (as a standby facility) was analyzed as well.
Based on the completed analyses, conclusions were made on robustness of the nuclear
facilities against external extreme events, and recommendations on their safety improvement
were provided.
On 3 November 2011, the SNRIU Board discussed the stress tests results for Chornobyl
NPP units 1-3 and ISF-1 and presented findings of the state nuclear and radiation safety
review of Chornobyl NPP stress tests. The Board’s meeting was attended by representativesof the State Exclusion Zone Management Agency of Ukraine, Ministry of Emergencies of
Ukraine, Supreme Council Fuel and Energy Committee, European Bank for Reconstruction
and Development, non-governmental organizations and mass media.
On 24-25 November 2011, the SNRIU Board discussed the results of stress tests for theoperating NPPs of Ukraine and findings of the state nuclear and radiation safety review. The
session was attended by representatives of non-governmental organizations, mass media,
Secretariat of the Cabinet of Ministers of Ukraine, dedicated committees of the Supreme
Council of Ukraine, Ministry of Energy and Coal Industry of Ukraine, regional stateadministrations and regional councils, and representatives of nuclear regulatory authorities of
Bulgaria, Germany, the Russian Federation, Slovak Republic.
On 24 June 2011, Ukraine signed the Declaration for stress tests at Ukrainian NPPs
(within the Ministerial Conference for preparation for and implementation of stress tests at
NPPs in the EU and neighboring countries). The stress test results for Ukrainian NPPs will
be assessed by independent European experts (peer reviews). Approaches to peer reviewsof the stress test results for the European NPPs and requirements for national reports onstress tests were adopted at the ENSREG meeting of 11 October 2011.
This Report has been developed by the State Nuclear Regulatory Inspectorate of Ukraine
based on the results of stress tests performed by the operating organizations for all operating
NPPs and units 1-3 and ISF-1 of the Chornobyl NPP, with account for findings of the state
nuclear and radiation safety review. The Report is in line with the ENSREG requirements forthe contents and format of National Reports (Post-Fukushima stress tests of European
Nuclear Power Plants – Contents and Format of National Reports). The Report was reviewed
and approved at the session of the SNRIU Board on 20 December 2011.
Part 1 of the Report describes the stress test results for the operating NPPs
(Zaporizhzhya NPP, Khmelnitsky NPP, Rivne NPP and South Ukraine NPP). The stress test
results for the Chornobyl NPP are presented in Part 2.

4

STATE NUCLEAR REGULATORY INSPECTORATE OF UKRAINENATIONAL REPORT ON STRESS TEST RESULTSTABLE OF CONTENTSPART 1. OPERATING NPPs OF UKRAINE
1. General data on the sites and Nuclear Power Plants of Ukraine ...................................... 6
1 Z General data on the Zaporizhzhya NPP........................................................................ 9
1 Kh General data on the Khmelnitsky NPP........................................................................ 18
1 R General data on the Rivne NPP ................................................................................. 20
1 SU General data on the South Ukraine NPP.................................................................... 30
2. Earthquakes................................................................................................................... 38
3. Flooding......................................................................................................................... 48
3 Z Flooding (Zaporizhzhya NPP) ..................................................................................... 48
3 Kh Flooding (Khmelnitsky NPP) ....................................................................................... 52
3 R Flooding (Rivne NPP)................................................................................................. 54
3 SU Flooding (South Ukraine NPP) ................................................................................... 56
4. Extreme weather conditions........................................................................................... 59
5. Loss of electrical power and loss of ultimate heat sink ................................................... 66
6. Severe accident management........................................................................................ 78
7. General conclusions ...................................................................................................... 99

PART 2. CHORNOBYL NPP
1 Ch General data on the Chornobyl NPP ....................................................................... 105
2 Ch Earthquakes ............................................................................................................ 109
3 Ch Flooding .................................................................................................................. 111
4 Ch Extreme weather conditions .................................................................................... 111
5 Ch Loss of electrical power and loss of ultimate heat sink............................................. 113
6 Ch Severe accident management ................................................................................. 116
7 Ch General conclusions ................................................................................................ 122

5

STATE NUCLEAR REGULATORY INSPECTORATE OF UKRAINENATIONAL REPORT ON STRESS TEST RESULTSPART 1. OPERATING NPPs OF UKRAINE
1. GENERAL DATA ON THE SITES AND NUCLEAR POWER PLANTS OF
UKRAINE
There are currently 15 power units operated at four NPP sites in Ukraine with a total
installed electrical power of 13,835 MW, which constitutes 26.3% of the total installed
electrical power of all power plants in the country.

Ukrainian Nuclear Power Plants
Summary Information on Operating Units of Ukrainian NPPs:
NPP,
Unit No.
ZNPP
1
2
3
4
5
6
SUNPP
1
2
3
RNPP
1
2
3
4
KhNPP
1
2

Electric power,
MW

Reactor type

Connection to
the grid

Design lifetime
expiry date

1000
1000
1000
1000
1000
1000

V-320
V-320
V-320
V-320
V-320
V-320

10.12.1984
22.07.1985
10.12.1986
18.12.1987
14.08.1989
19.10.1995

10.12.2014
22.07.2015
10.12.2016
18.12.2017
14.08.2019
19.10.2025

1000
1000
1000

V-302
V-338
V-320

31.12.1982
09.01.1985
20.09.1989

31.12.2012
09.01.2015
20.09.2019

420
415
1000
1000

V-213
V-213
V-320
V-320

22.12.1980
22.12.1981
21.12.1986
10.10.2004

22.12.2010∗22.12.2011∗21.12.2016
10.10.2034

1000
1000

V-320
V-320

22.12.1987
08.08.2004

22.12.201708.08.2034∗

The operational lifetime was extended (December 10, 2010) based on the results of periodic safety
review for power units.
6

STATE NUCLEAR REGULATORY INSPECTORATE OF UKRAINENATIONAL REPORT ON STRESS TEST RESULTS

The National Nuclear Energy Generating Company “Energoatom” (NNEGC"Energoatom”) is the licensee of all operating NPPs. All the operating units of Ukrainian
NPPs have a license for nuclear installation operation:− Zaporizhzhya NPP. The license was issued by the State Nuclear Regulatory
Committee of Ukraine on 16 June 2004;− Khmelnitsky NPP. The license was issued by the State Nuclear Regulatory
Committee of Ukraine on 5 October 2004 (unit 1) and on 15 December 2005 (unit 2);− Rivne NPP. The license was issued by the State Nuclear Regulatory Committee of
Ukraine on 10 December 2010 (units 1, 2), on 10 December 2010 (unit 3) and on 6
April 2006 (unit 4);− South Ukraine NPP. The license was issued by the State Nuclear Regulatory
Committee of Ukraine on 19 July 2002.
Detailed information on the Zaporizhzhya NPP units and dry spent fuel storage facility(DSF) is provided in Section 1Z, on the Khmelnitsky NPP units in Section 1Kh, the Rivne
NPP in Section 1R and the South Ukraine NPP in Section 1SU.
Use of PSA as Part of Safety Assessment
According to regulatory requirements, the operating organization shall justify the safety of
NPP units in a comprehensive manner and represent the results in the Safety Analysis
Report (SAR). The safety analysis methodology combines complementary deterministic andprobabilistic methods.
The SAR structure and contents are determined in the regulatory document“Requirements for the Contents of the Safety Analysis Report for Operating Units of
Ukrainian NPPs with WWER Reactors”. The SAR consists of the Integrated Safety Analysis
Report and mandatory appendixes:−
Technical Safety Substantiation (TSS);−
Additional Materials on Safety Analysis (AMSA);−
Analysis of Design Basis Accidents (DBA);−
Analysis of Beyond Design Basis Accidents (BDBA);−
Probabilistic Safety Assessment (PSA).
The SAR structure and contents for the new power units commissioned in 2004,
Khmelnitsky-2 and Rivne-4, are determined in document KND 306.302-96 “Requirements for
the Contents of the Safety Analysis Report for NPPs with WWER Reactors for Issuing a
Commissioning License”. The SAR for Khmelnitsky-2 and Rivne-4 consists of 20 Chapters:−
Chapter 1 General Description of the Nuclear Power Plant;−
Chapter 2 Characteristics of the NPP Area and Site;−
Chapter 3 Design Substantiation for Buildings, Structures, Systems andComponents;−
Chapter 4 Reactor;−
Chapter 5 Reactor Coolant System and Related Systems;−
Chapter 6 Safety Systems;−
Chapter 7 Process Control Systems;−
Chapter 8 Power Supply;−
Chapter 9 Power Unit Auxiliary Systems;−
Chapter 10 Steam Turbine Facility;−
Chapter 11 Radioactive Waste Management;−
Chapter 12 Radiation Protection;−
Chapter 13 Operation;−
Chapter 14 Pre-commissioning Program;−
Chapter 15 Accident Analysis;−
Chapter 16 Safe Operation Limits and Conditions;−
Chapter 17 Quality Assurance;−
Chapter 18 Decommissioning;
7

STATE NUCLEAR REGULATORY INSPECTORATE OF UKRAINENATIONAL REPORT ON STRESS TEST RESULTS−−

Chapter 19 Probabilistic Safety Assessment;
Chapter 20 Fire Protection System.

The Probabilistic Safety Assessment (PSA) is a mandatory part of the Safety Analysis
Report (SAR). Both qualitative and quantitative safety assessments of NPPs are performed
within the PSA. The PSA results are used to:− demonstrate that the safety criteria are within the established limits for the coredamage frequency and the large early release frequency;− identify and analyze risk contributors and safety issues;− identify and analyze the key phenomena emerging in severe accidents;− improve emergency operating procedures and training programs;− identify NPP safety issues, evaluate effectiveness and adequacy ofcompensatory measures.
In compliance with the regulatory requirements, a full-scope PSA shall be developed aspart of the SAR to account for internal initiating events, internal and external hazards (fire,
flooding, etc.) for all operational states (nominal and low power, shutdown). The scope ofdeveloped PSAs for NPP units that has been approved by the State Nuclear Regulatory
Inspectorate of Ukraine is as follows:
Nominal power:− Level 1 PSA for internal initiating events;− Level 1 PSA for internal fires;− Level 1 PSA for internal flooding;− Level 1 PSA for external extreme events (hazards);− Level 1 PSA for consequences of compromised residual heat removal from thespent fuel pool;− Level 2 PSA for internal initiating events.
Low power and shutdown:−
Level 1 PSA for internal initiating events.
Besides, the level 2 PSA for low power and shutdown was developed for Zaporizhzhya-5
and got the approval of the State Nuclear Regulatory Inspectorate of Ukraine.
Upon results of deterministic and probabilistic safety assessments (within the SAR) the“Comprehensive (Integrated) Safety Improvement Program for Ukrainian NPPs” wasdeveloped. On 30 November 2010, the State Nuclear Regulatory Inspectorate of Ukraine
and the Ministry of Energy and Coal Industry of Ukraine approved this Program.
In addition to various hardware upgrades, the Program includes comprehensive activities
on extending PSA studies for all NPPs to address all potential internal and external hazards
for the core and spent fuel pool in all operating modes, as well as development of the seismic
PSA studies.

8

STATE NUCLEAR REGULATORY INSPECTORATE OF UKRAINENATIONAL REPORT ON STRESS TEST RESULTS

1 Z GENERAL DATA ON THE ZAPORIZHZHYA NPP
1.1 Z Brief Description of the Site Characteristics
The Zaporizhzhya NPP site is situated in the Kamenka-Dniprovska district of theZaporizhzhya region on the left bank of the Kakhovka water reservoir (Dnipro river).

Zaporizhzhya NPP
The district center, the town of Kamenka-Dniprovska, is situated at a distance of 12 km
from the Zaporizhzhya NPP site, 52 km from the regional center, the city of Zaporizhzhya,
and at a distance of 5 km from the satellite town of Energodar.
The local relief of the Zaporizhzhya NPP site is flat, with alternating sand hummocks andhollows. The site leveling elevation is taken as 22.0 m.
The vehicle access is provided via the 6 km motor road built during Zaporizhzhya NPP
construction.
The railway siding adjoins the railway access of Zaporizhzhya thermal power plant with anexit to the external railway network.
There are following industrial facilities within a 10-km radius of ZNPP (the distance ismeasured from the Zaporizhzhya NPP site):− Zaporizhzhya thermal power plant rated 3600 MW, 2.5 km off the site;− industrial area (house-building factory, plant of non-standard metal and reinforced
concrete panel and honeycomb structures, plant of auxiliary boiler equipment,
plant of non-standard equipment and pipes), 3 km off the site;− cargo terminal for the Zaporizhzhya NPP and thermal power plant at the
Kakhovka water reservoir, 0.83 km off the site;− storage facilities of the Zaporizhzhya NPP, 4 km off the site.
There are no chemical or oil-refining plants, mines, open-cast mines, oil pipes, well drills,
boreholes of underground gas reservoirs, docks, ports, airports and other facilities in the areathat could affect the Zaporizhzhya NPP.
There are six power units operated at the Zaporizhzhya NPP site with WWER-1000/320
reactors with the total electric power of 6000 MW.
9STATE NUCLEAR REGULATORY INSPECTORATE OF UKRAINENATIONAL REPORT ON STRESS TEST RESULTS

1.1.1 Z Main Characteristics of the Units
1.1.1.1 Z Reactor Facilities
The main equipment of Zaporizhzhya NPP units 1-6:
− Water-cooled water-moderated pressurized(V-320 series);− Turbine unit K-1000-60/1500-2;− Electric generator TVV-1000-4.

powerreactor

WWER-1000

The reactor facilities of Zaporizhzhya NPP units 1-6 are designed to consist of two
circuits. Each reactor facility (RF) is equipped with a water-cooled water-moderatedpressurized power reactor WWER-1000 (V-320 series).

Layout Diagram of Main Equipment of WWER-1000/320
Systems and equipment of WWER-1000/V-320 assure:− safe and reliable reactor operation under all normal operation modes envisagedby the design;− operation control and monitoring for reactor major equipment;− integrity of the reactor in all design-basis accidents;− integrity and reliable cooling of the fuel assemblies in the reactor core under all
operational modes envisaged by the design.
RF equipment is housed in the pre-stressed leak-tight reinforced-concrete containment
having the shape of a hollow cylinder with a spherical dome and flat bottom. The reinforced
concrete wall of the containment is 1.2 m thick in its cylinder-shaped section and 1.1 m thickin its dome section. There is leak-tight 8-mm metal lining on the internal side of thecontainment.
1.1.1.2 Z Spent Fuel Storage Facilities
The spent fuel assemblies unloaded from the core are stored in racks in the spent fuelpools (SFP). Before placing for storage, the fuel assemblies are subjected to fuel cladding
leak testing. Based on the testing results, a spent fuel assembly is placed either in the rackslots or in a sealed canister. The spent fuel storage system is housed in the reactor
compartment provided with all necessary rooms and equipment to receive and store thespent fuel assemblies.
The SFP is housed inside the containment and consists of three compartments designed
for storage of spent fuel assemblies, and a well which is an area for loading of transport
10

STATE NUCLEAR REGULATORY INSPECTORATE OF UKRAINENATIONAL REPORT ON STRESS TEST RESULTS

casks with spent fuel assemblies and unloading of fresh fuel casing. Dividing the SFP into
three compartments allows for maintenance in one of them while spent fuel assemblies areplaced into the remaining two. The well stands separately from the fuel storage area, which
permits installation of a fresh fuel casing into the dry well.
The SFP is adjacent to the reactor and is connected with upper part of the reactor cavity
by a refueling channel for transport of fuel assemblies. The pool is equipped with spent fuelstorage racks.
The SFP is filled with a boric acid solution of at least 16 g/dm3 concentration. Water ineach SFP compartment circulates through the SFP cooldown system that keeps the SFP
water temperature within a permissible limit of no more than 70°С (with the reactor corecompletely unloaded). This value is established to prevent boiling of the cooling water andfuel melting induced by decay heat. In addition, the cooldown system ensures a protective
level of water in the SFP during spent fuel storage and provides radiation protection formaintenance personnel.
In an emergency situation there is a possibility for makeup and fuel cooling in SFP
compartments with a 16 g/dm3 boric acid solution from pumps of the containment spraysystem. In this case makeup and water cooling in SFP proceeds as follows: containment
sump – emergency cooldown heat exchanger – containment spray pump – SFP
compartment – SFP flow through the transport opening to the refueling pool – water flow
through the lower elevation of the containment to the containment sump.
Dry Spent Fuel Storage Facility
For further storage of spent fuel from all Zaporizhzhya power units, there is a dry spent
fuel storage facility) on the Zaporizhzhya NPP site.
The DSF is designed for safe storage of 380 containers VSC-WWER (over 9000 spent
fuel assemblies). The system is passive; thus, after concrete containers are placed on thestorage site no major maintenance efforts will be required. As of 30 June 2011, there was
DSF Stage 1 in operation designed to accommodate 100 containers.
The DSF is situated in the north-eastern part of the Zaporizhzhya NPP site at 21.80 m
elevation. The DSF is protected along the perimeter with a radiation protection structure,
which is a concrete wall 300 mm thick and 6 m high.
The DSF loading areas are situated in reactor buildings of all power units at 36.9 m
elevation and in passageways at 0.0 elevation. These areas for spent fuel loading andtransportation are equipped with transfer and handling equipment: overhead pivoting cranes
and refueling machines.
The DSF transportation area is a road network used to deliver VSC-WWER containers
from the loading area to the storage area. A dedicated container transporter envisaged by
the DSF design is used for container transportation. The DSF storage site is located in the
open area. To install the containers in their storage place, the above-mentioned containertransporter is used.

11

STATE NUCLEAR REGULATORY INSPECTORATE OF UKRAINENATIONAL REPORT ON STRESS TEST RESULTS

Cycles of Operations for Transportation of Spent Fuel Assemblies from the SFPs ofZaporizhzhya NPP Units to the DSF Site
1.1.2 Z Description of the Systems for Conduction of Main Safety Functions
The reactor coolant system (RCS) consists of a reactor and four circulation loops, eachconsisting of a steam generator PGV-1000M, main coolant pump (MCP) GTsN-195M, and
RCS piping. The RCS piping consists of pipes 850 mm in inner diameter and 70 mm inthickness. Each loop of the primary circuit is divided into “cold” and “hot” legs. The “hot” leg
supplies the coolant from the reactor to the steam generator, while the “cold” leg returns thecoolant from the steam generator to the reactor via the MCP. The design of all loops issimilar, ensuring equal hydraulic resistance of the loops and, thus, equal coolant flow rate.
The RCS piping is designed to meet the requirements for prevention of radioactivity release
into the environment. The design ensures normal operation of the reactor facility subjected toearthquake-induced loads reaching the design-basis values, and ensures safe shutdown andcooling. Thermal expansions of the piping are compensated by moving the steam generatorsand MCP that rest on rolling supports.
The PGV-1000M steam generator is a single-shell recuperative horizontal heat-exchanger
with a tubing bundle immersed into it and is designed for generation of dry saturated steam.
The main coolant pump GTsN-195M is designed for coolant circulation in the primarycircuit and is a vertical centrifugal single-stage pump with hydrostatic seal, console work
wheel, axial water supply and a self-contained three-phase asynchronous electric motor witha short-circuited rotor.

12

STATE NUCLEAR REGULATORY INSPECTORATE OF UKRAINENATIONAL REPORT ON STRESS TEST RESULTS

To achieve the main safety goal, which is to prevent radioactive releases beyond thephysical barriers, the design provides for the following safety functions:− reactivity control;− reactor core cooling;− confinement of radioactive substances within the established boundaries.
These safety functions in compliance with the defense-in-depth principle are inherent in
the WWER design.
Reactivity Control
Reactivity control and reactor transfer to sub-criticality as well as maintaining the reactor
core sub-critical are ensured through reactivity control systems based on different principles:− system of control rods mechanical movement in the reactor core (reactor power
control and scram – reactor protection system);− boric acid control system to regulate boric acid concentration in the coolant (thesystem is designed to control reactivity related to fuel burnup and transients aswell as to keep the core subcritical in reactor shutdown and transfer to cold
shutdown or hot standby mode).
The control rods are controlled through the reactor protection system (RPS). Control rods
are placed in the uppermost position when the reactor is at nominal power, except for the
one control rods group. Reactor scram is achieved by insertion of all rods into the core in the
shortest time.
In normal operation, the boron control function rests with the primary makeup and letdown
system.
In emergency modes, there are provisions for the regulation of boric acid concentration in
the primary coolant using safety systems integrated in the ECCS (emergency core coolingsystem):− high-pressure boron injection system (TQ14,24,34);− high-pressure injection system (TQ13,23,33);− passive ECCS (hydroaccumulators YT11,12,13,14B01);− low-pressure injection system (TQ12,22,32).
Each of the ECCS systems has three trains. The passive ECCS consists of 4hydroaccumulators: with the two supplying water to the reactor upper plenum, and the othertwo to the lower plenum.
Emergency systems are actuated automatically in response to emergency signals, theoperating mode and sequence of actuation and operation depends on the initiating event.
In accidents, the ECCS systems supply the primary circuit with the boron-containing
coolant (thus ensuring the reactor core transfer to subcriticality and maintaining the coresubcritical for a long time after reactor scram) and perform the “core cooling” safety function.
To ensure nuclear safety in reactivity control, neutron flux parameters (density, neutron
power, reactivity and period) are monitored on a permanent basis by appropriate
instrumentation and control systems; concentrations of boric acid in the reactor and trains ofsafety systems are monitored as well.
Core Cooling
The key objective of this function is to prevent fuel failure as a result of overheating. For
this purpose, there are heat removal systems and equipment in all operational modes. Heatremoval from the reactor core under WWER normal operation proceeds as follows: reactor
core – primary coolant – steam generator – secondary coolant – ultimate heat sink –atmosphere. During accidents and after reactor shutdown, residual heat is removed in thesame sequence. If steam generators are unavailable for heat removal function, the heat isremoved through the emergency core cooling system.
13

STATE NUCLEAR REGULATORY INSPECTORATE OF UKRAINENATIONAL REPORT ON STRESS TEST RESULTS

Fuel cooling in normal operation and anticipated operational occurrences under primarycircuit integrity
At the first cooldown stage, the heat from the reactor core is removed through thesecondary circuit system. Steam is removed through the steam dump valve to condenser(BRU-K) or the steam dump valve to atmosphere (BRU-A) in case of loss of off-site power or
any other initiating event when BRU-K operation is impossible, as well as through steam
generator safety relief valves in case both BRU-K and BRU-A are unavailable. When watersupply to steam generators through the main and auxiliary feedwater systems is impossible,
feedwater is supplied by the emergency feedwater system (TX10-30).
Long-term cold shutdown is ensured through the low-pressure injection system(TQ12,22,32). ECCS heat exchangers are cooled through the essential service water
system, which is also used to cool other components important to safety.
Core cooling under loss-of-coolant accident
In case of LOCA which cannot be compensated for by the makeup and letdown system,
the emergency core cooling systems are actuated. ECCS supplies the core withconcentrated boric acid solution to maintain sufficient coolant inventory in the primary circuit
to ensure core cooling, residual heat removal and maintain the core subcritical due toprimary circuit makeup with borated water.
Core cooling during cold shutdown or refueling
Low-pressure injection system is used. All three system trains provide borated watersupply to the reactor lower or upper plenum, with the flow direction selected automaticallydepending on the mode; in case of cooldown for maintenance purposes, water is supplied
only to the upper plenum. Two trains are connected to the main borated water pipes fromhydroaccumulators, while the third one to cold and hot legs of the primary circuit.
Limitation of Radioactivity Release
This safety function is aimed at preventing radioactive releases beyond the nuclear power
plant site.
In accidents, fuel can be damaged due to overheating and thus radioactive substances
will release into the primary circuit. To limit radioactivity releases in accidents, the design
provides for localization safety system (components), which are systems (components)
designed to prevent or limit release of radioactive materials and ionizing radiation beyond theboundaries specified in the design.
The localization safety system consists of a containment system and various processsystems ensuring confinement of accident products and pressure decrease in the reactor
containment (RC): containment spray system (TQ11,21,31), air-operated isolation valves,
penetrations, hydrogen concentration monitoring systems, passive autocatalytic hydrogen
recombiners, etc.
Safety Systems
The safety systems are designed to perform safety functions in case of an initiating event
and any independent single failure of one active or passive component with mechanicalmoving parts, or an additional human error.
All NPP safety systems are designed according to the redundancy principle. Each safetysystem consists of three independent trains. Each train in terms of its efficiency, responsetime and other factors is sufficient to perform the intended functions in the full scope definedfor a given system under any operational mode, including maximum design-basis accident(double-ended break of the main coolant piping DN 850 mm under loss of of-site power).
Independence of each safety system trains is ensured by complete physical separation of
the trains. Equipment of the respective safety system trains is actuated automatically inresponse to independent signals.
14

STATE NUCLEAR REGULATORY INSPECTORATE OF UKRAINENATIONAL REPORT ON STRESS TEST RESULTS

WWER-1000/V-320 Main Safety Systems and their Functions
SystemIntended Use under Normal
Intended Use in Emergencies
Operation
Protective safety systems

Reactor Protection
System (mechanicalside)
High-pressure Boron
Injection System
TQ14,24,34

Compensate for reactivity
changes and reactor power
control

Reactor emergency power decrease or reactor
scram by insertion control rods into the core

Under normal operation thesystem is in standby; the systemisperiodicallytestedincompliance with the operatingproceduresHigh-pressure
Injection System
TQ13,23,33

Under normal operation, thesystem is in standby; the systemisperiodicallytestedincompliance with the operatingprocedures

Passive ECCS
YT11, 12, 13, 14

Under normal operation, thesystem is in standby; the systemisperiodicallytestedincompliance with the operatingprocedures
Residual heat removal from thereactor core and primary circuit
cooldown.

In emergencies and accidents, each train of thesystem ensures boron concentrate injection
3(40g/dm ) into the primary circuit at any primarypressure (up to the maximum permitted) at a flow3
rate of 6m /h, when the makeup and letdown
system performance is not sufficient or its
function of boron injection into the primary circuit
is lost.
The pump is actuated automatically upon thesignal from the sequential loading program (SLP)or by the operator. To inject the boron
concentrate into the primary circuit, the operator
must close the valves on the recirculation line
using control switches.
“Under primary pressure decrease below 100
2
kgf/cm , each safety system train ensures boron
3
concentrate (40g/dm ) injection into the primarycircuit at a flow rate of ≈ 130t/h. After the boric
acid tank is emptied, the train is automaticallyconnected to the RC sump, thus initiating theclosed-cycle system operation.
The pump is actuated automatically upon the
ECCS signal or the SLP signal.
The systems ensures injection of boric acid of
3
16g/dm concentration and 55-60°С temperature
into reactor under primary pressure below 5.92
MPa (60 kgf/cm ) thus ensuring core cooling andfilling under loss of coolant accidents.
Emergency core cooling and residual heatremoval from the reactor core in accidents
requiring the reactor transfer into “coldshutdown” mode.
The pump is actuated automatically upon the
ECCS signal or the SLP signal.
To prevent primary equipment and piping
damage in pressure increase beyond the safe
operation limits.
To decrease primary pressure to ensure the feed
and bleed procedure by means of the highpressure injection system.
The system ensures complete filling of the corewith coolant for reliable heat removal due to gas
bubbles in the upper dead-end sections of the
primary piping that release from the coolant
when its temperature decreases to saturation
margin in case of emergency pressure decrease
above the core.
Primary pressure decrease to restore conditions
permitting actuation of high-pressure injection
system pumps.

Low-pressure Injection
System TQ12,22,32

Primary Overpressure
Protection System YP

PORV is in standby. There arethree PORVs installed – one
control and two operating.

Emergency Gas
Evacuation System YR

During unit startup the system
ensures gas evacuation when
the primary circuit is filling
When reactor is at nominal
power, the system is not used
and is maintained available.
During unit shutdown, the system
ensuresthat
theprimaryequipment metal is cooled evenly(reactor head, SG headerspressurizer upper head)
SG RV is in standby.

Secondary
Overpressure
Protection System
ТХ50,60,70,80

Steam generator vessel and piping overpressure
protection in operational occurrences andemergencies.

15

STATE NUCLEAR REGULATORY INSPECTORATE OF UKRAINENATIONAL REPORT ON STRESS TEST RESULTS

SystemSteam Dump Valve to
Atmosphere
TX50,60,70,80S05(BRU-A, Russian
designation)

Emergency Feedwater
System ТХ10,20,30.

Intended Use under Normal
Operation
The steam dump valves toatmosphere (BRU-A) is designed
to ensure:•reactorresidual
heat
removal;•primary circuit cooldown insteam mode;•
steam generator pressure
control in case of failure of thesteam dump valves to thecondenser or prohibition of their
opening.
In standby.

Main Steam Isolation
Valve System

In standby.

Containment System

Under normal operation, thecontainment system performs
functions of a normal operation
system, which include provisionof a closed space to confine
radioactive fission products
released during NPP operation
under various design modes.
In standby.

Intended Use in Emergencies
For secondary circuit overpressure protection
under normal operation and emergency modes.

Emergency feedwater system (EFS) actuated incase of failure of the normal SG feedwater
system. The EFS is actuated automatically forresidual heat removal at the first stage of
emergency cooldown.
The main steam isolation valve system (MSIV) is
designed to disconnect the broken steam line of
the emergency steam generator in non-isolated
section (before MSIV) from steam lines ofserviceable steam generators to limit deep
cooldown of the primary circuit through additional
steam makeup of leak places: measure toprevent development of a reactivity accident.

localization safety system

Containment spraysystem TQ11,21,31

Containment
HydrogenMeasurement System,
passive catalytichydrogen recombiners

In standby.

Control and Protection
System (CPS)

Reactor control during startup,
operation at nominal power andin shutdown states
In standby until actuation signal
is received, generates data onprocess parameters to be usedby personnel and actuates
alarms when major failuresoccur.

Limitation of radioactive releases into theatmosphere in emergencies and design-basis
accidents including maximum design-basis
accident.

Accident confinement by condensation of steam
generated as a result of primary coolant leak into
the containment. Pressure decrease in thecontainment. Immobilization of iodine in thesteam and air of the containment.
Makeup and cooling of spent nuclear fuel in the
spent fuel pool.
The hydrogen concentration reduction in thecontainment air to the non-explosive value indesign-basis accidents.

Control safety systems

Control Safety System(CSS)

Reactor control during accidents. Emergency
reactor unloading or reactor scram by the
emergency protection system.
Actuation of safety systems, their control andmonitoring during performance of safetyfunctions.

Supporting safety systems
Emergency diesel
generators (DG)

In standby.

Independent emergency supply to safetysystems.
In emergency modes requiring the operation ofsafety systems, the diesel generators are
actuated automatically and sequentially loaded.

16

STATE NUCLEAR REGULATORY INSPECTORATE OF UKRAINENATIONAL REPORT ON STRESS TEST RESULTS

SystemEssential Power
Supply System BV,
BW, BX

Essential Service
Water System (VF/QF)

Intended Use under Normal
Operation
Power supply from the working
transformer bus through two bus
switches on 6 kV bus and 6/0.4
transformers of the second
reliability group. Power supply toequipment fed from the 0.4 kVessential power supply bus, firstreliability group. Power supply tothe uninterruptible power supply
unit (UPS) of the direct-current
board and charging of thebattery.
Heat removal to the ultimate heatsink from normal operation
system equipment (spent fuelpool, intermediate circuit,ventilation systems …), as well
as from safety systemmechanisms.

Intended Use in Emergencies
Power supply to all safety system equipment.

Heat removal from the reactor core through the
ECCS heat exchangers, cooling of safetysystems’ mechanisms.

The following upgrades were performed at Zaporizhzhya NPP units 1-6 to facilitate
accident management:− establishing long-term make-up of emergency feedwater tanks and steam
generators (SG) under primary circuit emergency cooldown modes in loss ofhouse loads power. In 2011 stationary piping was installed at unit 1 to supply
cooling water from mobile sources (fire engines) under loss of power;− introduction of long-term make-up of emergency feedwater tanks and SGs underprimary circuit emergency cooldown modes in loss of house loads power using
fire hoses and mobile pumping units (fire engines) with the following connection
points: emergency feedwater pump discharge line ТХ10D01; emergency
feedwater tank inlet pipe ТХ10D01 on the feedwater line; suction pipe from tanks
TB40B01,02 of distillate pumps TN21(22,23) D01.
At Zaporizhzhya NPP units 1-6, the following is ensured to supply voltage to 6 kV auxiliary
buses:− power supply from the available units of the NPP site;− power supply to 6 kV standby lines from diesel generators of any safety systemof any power unit on the site or from the common-unit diesel generators;− power supply from Dnipro Hydraulic Power Plant-1, Dnipro Hydraulic Power
Plant-2, Zaporizhzhya Thermal Power Plant and Kakhovka Hydraulic Power
Plant.
1.2 Z

Significant Differences between Units

Zaporizhzhya NPP units 1-6 are of typical WWER-1000/V320 design and have similar
layout and arrangement. At the same time, there are the following significant differences
between the units:− the design provides for common-unit emergency diesel generators for units 5-6
that are housed in a separate building and are designed to provide power for the
categories 1 and 2 loads along with normal operation loads which provide forgood condition of basic technological equipment under loss of off-site power. The
system consists of two trains with autonomous diesel generators;− In 2011 stationary piping was installed at unit 1 to supply cooling water frommobile sources (fire engines) in case of loss of power.
There are no other significant differences between the Zaporizhzhya NPP units that would
influence the assessment of units’ vulnerability to external hazards or performance of safetyfunctions and severe accident management.

17

STATE NUCLEAR REGULATORY INSPECTORATE OF UKRAINENATIONAL REPORT ON STRESS TEST RESULTS

1.3 Z

Use of PSA as Part of Safety Assessment

Information on PSAs for Zaporizhzhya NPP units 1-6 is provided in Section 1 "General
Data on the Sites and Nuclear Power Plants of Ukraine”.
Safety Substantiation of Dry Spent Fuel Storage Facility (DSF)
To substantiate safe operation of the DSF, a safety analysis report for the DSF wasdeveloped and approved by the State Nuclear Regulatory Inspectorate of Ukraine. The
analysis included:− strength analysis;− analysis of thermal and pressure effects;− biological shielding analysis;− nuclear safety analysis;− personnel dose analysis.
Based on the SAR results, conclusions were made on the DSF robustness against all
postulated external hazards and its safe operation.
1 Kh GENERAL DATA ON THE KHMELNITSKY NPP
1.1 Kh Brief Description of the Site Characteristics
The Khmelnitsky NPP site is located in the Slavuta district of the Khmelnitsky region.

Khmelnitsky NPP
The distance from the Khmelnitsky NPP site to the district center (Slavuta town) is 15 km
and to the regional center (Khmelnitsky town) is 100 km. The residential area closest to
Khmelnitsky NPP (2.7 km of reactor buildings) is Neteshin town situated north-west of the
NPP. The natural southern boundary of Neteshin is the Goryn river. An off-channel coolingreservoir is located in the south west of the NPP site in the floodplain of the Goryn river,which includes a retaining dam. In the south, the outdoor switchyard is sided by lands ownedby the Slavuta State Forestry.
All industrial facilities within 30 km from the NPP are mainly located in the towns ofNeteshin, Slavuta, Iziaslav and Ostrog. All NPP facilities are provided with an asphalt18

STATE NUCLEAR REGULATORY INSPECTORATE OF UKRAINENATIONAL REPORT ON STRESS TEST RESULTS

covered road network linked with the main road siding going from the NPP surrounding area
to the regional roadway Stryi–Ternopil (Р-05) on the Shepetovka-Ostrog-Berdichev highway.
The NPP site is connected with the South Western Railway (SWR) through the NPP
railroad station adjacent to the Seltso station of SWR.
There are no gas or oil pipelines, factories or chemical plants within the 30-km area of
Khmelnitsky NPP.
The Khmelnitsky NPP has been designed as a four-unit plant with WWER-1000/320
reactors 1000 MW each. To date, two power units have been constructed andcommissioned, units 1 and 2, with a total electrical power of 2000 MW.
1.1.1 Kh1.1.1.1 Kh

Main Characteristics of the Units
Reactor Facilities

There are two WWER-1000/B-320 units with a total electrical power of 2000 MW at the
Khmelnitsky NPP site.
The main equipment of Khmelnitsky NPP units 1 and 2 includes:− water-cooled water-moderated pressurized power(V-320 series);− turbine unit K-1000-60/3000;− generator TVV-1000-2UZ.

reactor

WWER-1000

The reactor facilities of Khmelnitsky NPP units 1 and 2 are of the WWER-1000/V-320
standard design and are similar to Zaporizhzhya NPP units 1-6.
1.1.1.2 Kh

Spent Fuel Storage Facilities

The Khmelnitsky NPP does not have any on-site spent fuel storage facilities.
Spent fuel removed from the reactor core is stored in storage racks of spent fuel pools.
The spent fuel storage system is arranged in the reactor building with all needed rooms andequipment to receipt and store spent fuel assemblies. The design of spent fuel pools of
Khmelnitsky NPP units 1 and 2 is similar to that of Zaporizhzhya NPP units 1-6 (See Section
1.1.1.2 Z).
1.1.2 Kh

Description of the Systems for Conduction of Main Safety Functions

The configuration of the main safety systems and normal operation systems important tosafety of Khmelnitsky NPP units 1 and 2 is similar to that of Zaporizhzhya NPP units 1-6. The
systems that perform safety functions are described in Section 1.1.2 Z.
In addition, several upgrades were implemented at Khmelnitsky NPP units 1 and 2 foraccident management:− establishing of long-term make-up of emergency feedwater tanks and steam
generators under primary circuit emergency cooldown modes in loss of houseloads power ;− introduction of long-term make-up of emergency feedwater tanks and SGs underprimary circuit emergency cooldown modes in loss of power to in-house loads
using fire hoses and mobile pumping units (fire engines) with the following
connection points: emergency feedwater pump discharge line ТХ10D01;
emergency feedwater tank inlet pipe ТХ10D01 on the feedwater line; suction pipe
from tanks TB40B01,02 of distillate pumps TN21(22,23)D01.
The upgrades implemented at Khmelnitsky NPP units 1 and 2 also included the following
features to supply voltage to 6kV auxiliary buses:− power supply from the available units of the NPP site;− power supply to 6kV standby line from diesel generators of safety systems of any
unit located on site or from emergency diesel generators.

19

STATE NUCLEAR REGULATORY INSPECTORATE OF UKRAINENATIONAL REPORT ON STRESS TEST RESULTS

1.2 Kh Significant Differences between Units
Khmelnitsky NPP units 1 and 2 are of identical design and have similar reactor facilities,
layout and arrangement. However, similarly to Zaporizhzhya NPP Units 5 and 6, the designof Khmelnitsky NPP unit 2 additionally provides for a common-unit essential power supply
system including two trains with independent diesel generators. The power of each diesel
generator (5600 MW) was selected to ensure its startup in case of blackout of both power
units (in case one of the diesel generators fails).
It should be noted that an ALSTOM hydrogen monitoring system has been installed in thecontainment of the unit 2 to monitor hydrogen concentration in all operating modes, while thissystem has not been installed at unit 1, which is a significant difference between the units
relative to accident management capabilities.
In all other respects, there are no significant differences between the units that may affectthe assessment of their vulnerability to external hazards and performance of safety functions.
1.3 Kh Use of PSA as Part of Safety Assessment
Information on PSAs for Khmelnitsky NPP units 1 and 2 is provided in Section 1 "General
Data on the Sites and Nuclear Power Plants of Ukraine”.
1 R GENERAL DATA ON THE RIVNE NPP
1.1 R

Brief Description of the Site Characteristics

The Rivne NPP site is located in the north west of Ukraine at the border of Rivne andVolyn’ regions.

Rivne NPPThe distance from the Rivne NPP site to:− Kuznetsovsk town westward – 3 km;− district centre of Vladimirets to north-east – 20 km;− regional centre of Rivne to south-east – 80 km;− regional centre of Lutsk to south-west – 75 km.
20

STATE NUCLEAR REGULATORY INSPECTORATE OF UKRAINENATIONAL REPORT ON STRESS TEST RESULTS

All industrial plants within the 30-km area of the NPP are mainly located in Kuznetsovsk
and Vladimirets of the Rivne region and Manevichi of the Volyn’ region.
There are no gas or oil pipelines, factories or chemical plants in the Volyn’ region within
the 30-km area of the Rivne NPP.
The Kiev–Kovel highway extends 20 km to the south of the Rivne NPP site. To provide
the road connection to the Rivne NPP and in-site connections between different plantfacilities a system of roadways was constructed.
The main river crossing the whole territory of the 30-km area from south to north over 113
km is Styr’ river that is used to supply service water to the Rivne NPP.
There are four units with a total electrical power of 2835 MW at the Rivne NPP site: two
WWER-440/V-213 units (units 1 and 2) and two WWER-1000/V-320 units (units 3 and 4).
1.1.1 R Main Characteristics of the Units
1.1.1.1 R Reactor Facilities
Units 1 and 2
There are two WWER-440/213 units (units 1 and 2) with a total electrical power of 835
MW at Rivne NPP.
Major equipment of RNPP units 1 and 2 includes:− water-cooled water-moderated reactor WWER-440 (V-213);− turbine unit K-220-44;− generator TVV-220-2AUZ.
The reactor facilities of Rivne NPP units 1 and 2 consist of two circuits. The reactor
facilities of each power unit are located in separate buildings, and turbine generators in acommon turbine building.

Layout of WWER-440/V-213 Major Equipment
1 - reactor; 2 – steam generator; 3 – main coolant pump; 4 – “hot” leg; 5 - main gate valve on hot leg; 6 – maingate valve on cold leg; 7 - “cold” leg; 8 - pressurizer; 9 – pressure relief tank; 10 – ECCS hydroaccumulator

21

STATE NUCLEAR REGULATORY INSPECTORATE OF UKRAINENATIONAL REPORT ON STRESS TEST RESULTS

Systems and equipment of WWER-440/V-320 assure:− safe and reliable operation of the reactor in all normal operation modes
envisaged by the design;− control of operations and monitoring of major reactor equipment;− integrity of the reactor in all design-basis accidents;− integrity and reliable cooling of fuel assemblies in the reactor core under all
operation modes envisaged by the design.
The design of the reactor facility provides protection of NPP personnel and theenvironment against radiation according to health and safety standards in all operation
modes provided by the design (including anticipated transients and design-basis accidents).
To remove heat from turbine condensers and heat exchangers of auxiliary equipment,cooling towers of 100,000 m3/h capacity (each tower) are used. To remove heat fromessential loads, spray ponds are used.
The reactor facilities of units 1 and 2 are located inside containments of reactor buildings.
Units 3 and 4
There are also two WWER-1000/V-320 units (units 3 and 4) with a total electrical power2000 MW at the Rivne NPP.
Major equipment of RNPP units 3 and 4 includes:− water-cooled water-moderated reactor WWER-1000 (V-320);− turbine K-1000-60/3000;− generator TVV-1000-2UZ.
The reactor facilities of Rivne NPP units 3 and 4 are of WWER-1000/V320 standard
design and are similar to Zaporizhzhya NPP units 1-6.
1.1.1.2 R Spent Fuel Storage Facilities
There are no on-site spent fuel storage facilities on the Rivne NPP site.
Units 1 and 2
The spent fuel assemblies unloaded from the core are stored in racks in the spent fuelpools (SFP). Before placing for storage, the fuel assemblies are subjected to fuel cladding
leak testing. Based on the testing results, a spent fuel assembly is placed either in the rackslots or in a sealed canister. The spent fuel storage system is housed in the reactor
compartment provided with all necessary rooms and equipment to receive and store thespent fuel assemblies.
The SFP is located within the steam generator box and is connected with the reactor
through refueling channels for transportation of fuel assemblies. Spent fuel is stored andreloaded under a protective layer of water. The pool is equipped with a compacted fuelstorage system and storage racks that accommodate spent fuel assemblies, shieldassemblies, sealed canisters for damaged fuel and special tools.
The SFP is filled with a boric acid solution of at least 16 g/dm3 concentration. Water ineach SFP compartment circulates through the SFP cooling system that keeps the SFP watertemperature within a permissible limit of no more than 70°С (with the reactor core completely
unloaded). This value is established to prevent boiling of the cooling water and fuel melting
induced by decay heat. In addition, the cooling system ensures a protective level of water in
the SFP during spent fuel storage and provides radiation protection for maintenancepersonnel.
In case of emergency unloading of spent fuel from one power unit, the spent fuel pool of
the other power unit may be used if necessary.

22

STATE NUCLEAR REGULATORY INSPECTORATE OF UKRAINENATIONAL REPORT ON STRESS TEST RESULTS

Units 3 and 4
The spent fuel assemblies unloaded from the reactor core are stored in racks in the spent
fuel pools (SFP). The spent fuel storage system is housed in the reactor compartment
provided with all necessary equipment to receive and store the spent fuel assemblies. The
design of SFP of Rivne NPP units 3 and 4 is similar to that of Zaporizhzhya NPP units 1-6.
1.1.2 R Description of the Systems for Conduction of Main Safety Functions
Units 1 and 2
The reactor coolant system (RCS) of WWER-440/V-213 consists of six circulation loops.
Each loop includes: RCS piping; main coolant pump (MCP); steam generator; and main gate
valves to cut off any loop from the reactor. Each of the six circulation loops consists of “hot”
and “cold” legs: “hot” leg is used to transfer the coolant from the reactor to the steam
generator; “cold” leg is used to transfer the coolant cooled down in SG to MCP intake andback to the reactor. The cold and hot legs of each loop are provided with main gate valves(MGV) for isolation of the loop with a damaged component in case of accidents (SG or RCS
piping leakage in the cutoff section etc.).
The RCS piping is designed to prevent radioactive releases to the environment. The
design ensures normal operation of the reactor facility subjected to earthquake-induced
loads reaching the design-basis values, and ensures safe shutdown and cooling.
The PGV-213 steam generator is a single-pass recuperative horizontal heat-exchanger
with a tubing bundle immersed into it and is designed for generation of dry saturated steam.
The main coolant pump GTsN-317 is designed for coolant circulation in the primary circuit
and is a vertical single-stage centrifugal pump with hydrostatic seal, console work wheel,axial water supply and a self-contained three-phase asynchronous electric motor with ashort-circuited rotor.
The MGV with an in-built motor is used to cut off the loop during accidents caused bysteam line break and primary-to-secondary SG leakage when the reactor is alreadyscrammed. In normal operation, MGV is designed to transfer the loop to hot standby with
relevant decrease in reactor power.
To achieve the main safety goal, which is to prevent radioactive release beyond thephysical barriers, the design provides for the following safety functions:− reactivity control;− reactor core cooling;− confinement of radioactive substances within the established boundaries.
These safety functions in compliance with the defense-in-depth principle are inherent in
the WWER design.
Reactivity Control
Reactivity control and reactor transfer to sub-criticality as well as maintaining the reactor
core sub-critical are ensured through reactivity control systems based on different principles:− system of control rod mechanical movement in the reactor core (reactor power
adjustment and scram – reactor protection system);− boric acid control system to regulate boric acid concentration in the coolant (thesystem is designed to control reactivity related to fuel burnup and transients aswell as to keep the core subcritical in reactor shutdown and transfer to cold
shutdown or hot standby mode).
The control rods are controlled through the control and protection system (CPS). Control
rods are placed in the uppermost position when the reactor is at nominal power, except forthe control rod CPS. Reactor scram is achieved by insertion of all absorber rods into the corein the shortest time.
In normal operation, the boron control function rests with the primary makeup and letdown
system.
23

STATE NUCLEAR REGULATORY INSPECTORATE OF UKRAINENATIONAL REPORT ON STRESS TEST RESULTS

In emergency modes, there are provisions for the regulation of boric acid concentration in
the primary coolant using safety systems integrated in the ECCS (emergency core coolingsystem):− high pressure injection system;− passive ECCS (hydroaccumulators);− low-pressure injection system.
Each system, except for hydroaccumulators, is provided with three trains.
Emergency systems are actuated automatically in response to emergency signals, theoperating mode and sequence of actuation and operation depends on the initiating event.
In emergencies, the ECCS systems supply the primary circuit with the boron-containing
coolant (thus ensuring the reactor core transfer to subcriticality and maintaining the coresubcritical for a long time after reactor scram) and perform the “core cooling” safety function.
To ensure nuclear safety in reactivity control, neutron flux parameters (density, neutron
power, reactivity and period) are monitored on a permanent basis by appropriate
instrumentation and control systems; concentrations of boric acid in the reactor and trains ofsafety systems are monitored as well.
Core Cooling
The key objective of this function is to prevent fuel damage as a result of overheating. For
this purpose, there are heat removal systems and equipment in all operational modes. Heatremoval from the reactor core under WWER normal operation proceeds as follows: reactor
core – primary coolant – steam generator – secondary coolant – ultimate heat sink –atmosphere. During accidents and after reactor shutdown, residual heat is removed in thesame sequence. If steam generators are unavailable for heat removal function, the heat isremoved through the emergency core cooling system (ECCS) and essential service water
system.
Core cooling under loss-of-coolant accident
In case of LOCA which cannot be compensated for by the makeup and letdown system,
the emergency core cooling systems are actuated. ECCS (HPIS, LPIS andhydroaccumulators) supplies the core with concentrated boric acid solution to maintainsufficient coolant inventory in the primary circuit to ensure core cooling, residual heatremoval and maintain the core subcritical due to primary circuit makeup with borated water.
Core cooling during cold shutdown or refueling
Low-pressure injection system is used for this purpose. All three system trains provide
borated water supply to the reactor lower or upper plenum, with the flow direction selected
automatically depending on the mode; in case of cooldown for maintenance purposes, water
is supplied only to the upper plenum. Two trains are connected to the main borated water
pipes from hydroaccumulators, while the third one to cold and hot legs of the primarycirculation loop.
Limitation of Radioactivity Release
This safety function is aimed at preventing radioactive releases beyond the nuclear power
plant site. In case of primary circuit integrity failure, the radioactive releases to theenvironment are prevented by the localization safety system maintaining negative pressure
by means of ventilation systems.
To limit radioactivity releases in accidents, the design provides for localization safetysystems (components), which are systems (components) designed to prevent or limit releaseof radioactive materials and ionizing radiation beyond the boundaries specified in the design.
The localization safety system includes structural components and devices to limit theaccident confinement area represented by space where, according to the design, radioactive
substances are confined during and after an accident.
24

STATE NUCLEAR REGULATORY INSPECTORATE OF UKRAINENATIONAL REPORT ON STRESS TEST RESULTS

All equipment operating on radioactive coolant is located in containment compartments.
All containment compartments are made of reinforced concrete and designed to reduceradiation doses both in normal operation and during all accidents. The localization safetysystem is designed to sustain all design-basis loads resulting from coolant system failure, up
to DN 500 rupture of the main circulation piping and to confine radioactive materials inside
the containment, which ensure radiation parameters outside the containment within thepermissible limits according to current standards.
Safety Systems
The safety systems are designed to perform safety functions in case of an initiating event
and any independent single failure of one active or passive component with mechanicalmoving parts, or an additional human error.
All NPP safety systems are designed according to the redundancy principle. Each safetysystem consists of three independent trains. Each train in terms of its efficiency, responsetime and other factors is sufficient to perform the intended functions in the full scope definedfor a given system under any operational mode, including maximum design-basis accident(double-ended break of the main coolant piping DN 500 mm under loss of of-site power).
Independence of each safety system trains is ensured by complete physical separation of
the trains. Equipment of the respective safety system trains is actuated automatically inresponse to independent signals.
WWER-440/V-213 Main Safety Systems and Their Functions
SystemComposition of System(Train)Intended Use in
Emergencies

Intended Use inNormal Operation

Protective Safety Systems
Control & Protection
System (CPS)(mechanical side)

High-pressure
Injection System

Passive ECCS
(ECCShydroaccumulators)
Low-pressure
Injection System

Primary
Overpressure
Protection System

The mechanical circuit of
CPS consists of CPS
control rods (37 groups ofcontrol rods). All control
rods are divided in groups(1÷6)
The system consists ofthree independent trains.
Each train includes:
boric acid storage tank with
40g/kg boron solution;
primary emergency
makeup pump; valves;pipingConsists of two
independent trains. Eachtrain includes two boric acidhydroaccumulators with
16g/kg boron solution
Consists of three
independent trains. Eachtrain includes:
boric acid storage tank with
16 g/kg boron solution;
reactor coolant pump;
ECCS heat exchanger;
valves;pipingTransfer to and keep thereactor core in subcritical
state

Compensate forreactivity changes andcontrol reactor power

Emergency injection ofboron solution to thereactor core

Under normal
operation, the system isin standby; the system
is periodically tested incompliance with theoperating procedures

Emergency supply ofboric acid to the reactor
for core cooling and fillingin case of LOCA withprimary pipe break
Emergency cooldown of
the reactor core andfurther residual heatremoval for a long period
in LOCA

Under normal
operation, the system isin standby

Consists of two selfcontained pilot-operated
safety relief valves of thepressurizer

Protect RCS against
primary overpressure

Under normal
operation, the system isin standby;
the system isperiodically tested incompliance with theoperating procedure;
it is used during
refueling operations totransfer heat from thereactor core to ultimate
heat sink
Under normal
operation, the system isin standby;

25

STATE NUCLEAR REGULATORY INSPECTORATE OF UKRAINENATIONAL REPORT ON STRESS TEST RESULTS

SystemSecondary
Overpressure
Protection System
Primary Emergency
Gas Evacuation
SystemEmergency Reactor
Cooldown System

Main Steam Isolation
Valves System

Emergency
Feedwater System

Containment System

Composition of System(Train)Each steam generator isequipped with two pilotoperated safety relief
valvesIntended Use in
Emergencies

Secondary system
overpressure protection
in operational
occurrences andemergencies.
Consists of piping
The system ensuresconnecting SG headers
complete filling of theand RPV head with thecore with coolant forpressure relief tankreliable heat removal due
to removal of gas bubbles
in the upper dead-end
sections of the primarypiping that release fromthe coolant when its
temperature decreases tosaturation margin in caseof emergency pressure
decrease above the core.
Remove heat from theConsists of two Steamreactor in emergencies
Dump Valve tocaused by unit blackout,
Atmosphere
design-basis seismic
loads and otheremergencies resulting
from compromised heatremoval from the reactor
Each SG is equipped with
The system is designed
one MSIV, and three valves to disconnect theare installed on the main
emergency steam
steam header dividing it
generator with broken
into two symmetric sections steam line in non-isolated
section (before MSIV)
from steam lines ofserviceable steam
generators to limit deep
cooldown of the primarycircuit due to additional
steam makeup: measure
to prevent developmentof a reactivity accident.
Consists of two feedwater
Support the required
tanks, three auxiliary
feedwater level in SG tomotor-driven emergency
ensure core heat removal
feedwater pumps, piping,and prevent unacceptable
valves; control
overheating and damageof fuel in accidents. The
system is used in unit
emergency cooldown
Localization safety system
Consists of:Confine radioactive
reinforced concrete
substances releases
enclosing structures withwithin the accident
leak-tight steel lining
confinement area, isolate(embedded parts, including from the environment theanchors);
systems andpenetrations (process,components, protect
cable, ventilating etc.),
personnel and the public
airlocks, hatches, doors
against radiation andand their embedded parts;
radioactivity effects
overflow and safety valves;
distribution line sections
intersecting thecontainment within
confining structures;
isolating structures

Intended Use inNormal Operation
Under normal
operation, the system isin standby;

Under normal
operation, the system isin standby;

Not used, maintained
available (in automaticstandby)In standby.

In standby.

The system is used tocreate and maintainrarefaction insidecompartments adjacentto the reactor, ismaintained available
and periodicallyinspected according to
the establishedprocedures

26

STATE NUCLEAR REGULATORY INSPECTORATE OF UKRAINENATIONAL REPORT ON STRESS TEST RESULTS

SystemComposition of System(Train)Passive Hydrogencatalytic
Recombiners (PAR)Consists of PAR modules
to ensure sufficienthydrogen removal rate
inside the containment,

Passive Steam
Condenser

Consists of passive
confining features – air trap
rooms and suppression
pools filled with boric acidsolutionSpray System

Consists of three
independent trains. Eachtrain includes:containment spray pump;
boric solution tank;piping;valvesEssential Service
Water System

Consists of three
independent trains. Eachtrain includes:
on spray pond section;
emergency storage tank;two essential service water
pumps;
piping;valvesConsists of three
independent trains. Eachtrain includes selfcontained power supply
sources (batteries);transducers (rectifiers,
inverters); switchyards anddistribution system (cables
in cable routings)
Consists of three
independent trains. Eachtrain includes one dieselgenerator with selfcontained fuel, oil, coolingwater, power, ventilationand compressed-air
systems

Intended Use in
Emergencies
The hydrogenconcentration reduction in
the containment air to thenon-explosive value indesign-basis accidents.
Protect containment
compartments against
overpressure in medium
and large primary coolant
leaks by condensation of
steam generated during
an accident that caused
by primary piping break;remove radioactive
products from the steamgas mixture during
operation of the passive
steam condenser;
prevent emergency
radioactive releases into
the environment
Reduce pressure to
rarefied atmosphere andmaintain it inside thecontainment during
accidents caused byprimary and secondary
piping rupture;
Immobilize iodine
contained in steam-gas
medium; mix the steamgas medium incompartments

Intended Use inNormal Operation
In standby.

Not used

In standby.

Supporting Safety Systems

Emergency Power
Supply System

System of
Emergency Diesel
Generators

Heat removal from thereactor core through the
ECCS heat exchangers,
cooling of safety systems’
mechanisms.

Provide uninterruptable
power supply to safetysystem loads of reliability
group 1 in normal
operation, operational
occurrences andemergencies (including
unit blackout)
Provide power supply tosafety system loads ofreliability group 2 during
unit blackout

Heat removal to theultimate heat sink fromnormal operation
system equipment(spent fuel pool,intermediate circuit,ventilation systems …),
as well as from safetysystem mechanisms.
Used for equipment
designed to perform
safety functions;remains in continuous
operation; the system isperiodically tested incompliance with theoperating procedures
Not used, maintained
available (in automaticstandby); the system isperiodically tested incompliance with theoperating procedures

Control Safety Systems

27

STATE NUCLEAR REGULATORY INSPECTORATE OF UKRAINENATIONAL REPORT ON STRESS TEST RESULTS

SystemControl andProtection System(CPS)

ECCS Protection
Alarm System

Composition of System(Train)Consists of:electric control equipment
for control roods; power
supply system and systemfor conversion of powerfrom NPP in-house sourcesand distribution to otherloads; two independent
sets of process control
equipment; twoindependent processmonitoring equipment sets;
two independent neutron
flux monitoring sets (AKNP7);
power limiting device ROM2S;
automatic power controller
ARM-5S
Consists of three
independent trains. Eachtrain includes:
process instrumentation
circuit that consists of three
independent
instrumentation channels;
signal monitoring circuitand sensor mismatch alarm
circuit;fuse check or cutoff circuit;power control circuit for
output and testing relays;
ECCS protection testing
circuit;safety system actuation
relay system

Intended Use in
Emergencies

Intended Use inNormal Operation

Initiate automatic reactor
core transfer to subcriticalstate;
protect the reactor coreagainst unacceptabledeviation of basic
parameters;
provide automatic
insertion of all control
rods to the lowermost
position

Reactor power control,
including automatic
control; limitation ofreactor thermal power;
monitoring of neutron
power, control of theneutron flux rate;
the system isperiodically tested incompliance with theoperating procedures

Activate safety systems incase of emergencies(including unit blackout)

Not used, maintained
available (in automaticstandby); the system isperiodically tested incompliance with theoperating procedures

In case of common-cause failure of all main and emergency feedwater supply systems,
feedwater is supplied through the steam generator additional emergency steam generator
feedwater system (AEFS). The system was installed and commissioned in 2010. The AEFS
is located in a separate building that was specially constructed; feedwater tanks are locatedoutside the AEFS building on individual foundations and are connected with the AEFS
building by an underground channel. The system is designed to:− keep the required coolant level in steam generators to ensure heat removal fromthe reactor core,− provide emergency shutdown of units 1 and 2 and their safe transfer to cold statein case the main and emergency feedwater supply systems fail under different
initiating events.
This system is common for Rivne NPP units 1 and 2 and consists of three independent
subsystems, each designed for the relevant unit. The subsystems consist of:− one diesel-operated pump RR91(92)D01 with auxiliary generators;− one feedwater tank RR91(92)B01 (1000 m3);
− main pump pressure header.
This system is independent and survivable because its performance does not depend onother safety systems and normal operation systems. AEFS pumps are driven directly by theirown air-cooled diesel engines. In case of station blackout, the AEFS inventory is sufficient toensure long-term decay heat removal. Also, the AEFS tanks can be refilled.

28

STATE NUCLEAR REGULATORY INSPECTORATE OF UKRAINENATIONAL REPORT ON STRESS TEST RESULTS

The following power supply options are ensured at Rivne NPP units 1 and 2 in case of
blackout:− power supply from the available units of the NPP site power supply to 6 kVstandby lines from diesel generators of any safety system of any power unit on
the site or from the common-unit emergency diesel generators.
Units 3 and 4
The configuration of the main safety systems and normal operation systems important tosafety of Rivne NPP units 3 and 4 is similar to that of Zaporizhzhya NPP units 1-6. The
systems that perform safety functions for WWER-1000/320 are described in Section 1.1.2 Z.
The following upgrades were performed at Rivne NPP unit 3 and 4 for accident
management:− introduction of long-term make-up of emergency feedwater tanks and steam
generators (SG) under primary circuit emergency cooldown modes in loss ofhouse loads power ;− introduction of long-term make-up of emergency feedwater tanks and SGs underprimary circuit emergency cooldown modes in loss of power to in-house loads
using fire hoses and mobile pumping units (fire engines) with the following
connection points: emergency feedwater pump discharge line ТХ10D01;
emergency feedwater tank inlet pipe ТХ10D01 on the feedwater line; suction pipe
from tanks TB40B01,02 of distillate pumps TN21(22,23)D01.
The upgrades implemented at Rivne NPP units 3 and 4 also included the following options
in case of blackout:− power supply from the available units of the NPP site;− power supply to 6 kV standby lines from diesel generators of any safety systemof any power unit on the site or from the common-unit emergency diesel
generators.
1.2 R

Significant Differences between Units

Units 1 and 2
Rivne NPP units 1 and 2 are of standard WWER-440/V213 design and have similar layout
and arrangement and have no significant differences that may affect assessment of theirvulnerability to external hazards, performance of safety functions or severe accident
management.
Units 3 and 4
Rivne NPP units 3 and 4 are of standard WWER-1000/V320 design and have similar
reactor facilities, layout and arrangement. However, the design of unit 4 additionally provides
for a common-unit emergency diesel generator system including two trains with independent
diesel generators. The power of each diesel generator (5600 MW) was selected to ensure its
startup in case of blackout of both power units.
There are also differences between units in terms of implementation of safety
improvement measures: modernization of CPS control system, including power supply
system has been implemented at unit 3 and has not been started yet at unit 4.
In all other respects, there are no significant differences between units 3 and 4 that may
affect the assessment of their vulnerability to external hazards and performance of safetyfunctions.
1.3 R Use of PSA as Part of Safety Assessment
Information on PSAs for Rivne NPP units 1-4 is provided in Section 1 "General Data on
the Sites and Nuclear Power Plants of Ukraine”.

29

STATE NUCLEAR REGULATORY INSPECTORATE OF UKRAINENATIONAL REPORT ON STRESS TEST RESULTS

1 SU GENERAL DATA ON THE SOUTH UKRAINE NPP
1.1 SU Brief Description of the Site Characteristics
The South Ukraine NPP site is located in the Arbuzinka district in the Mykolayiv region, on
the left bank of the Yuzhny Bug river.

South Ukraine NPPThe South Ukraine NPP with all main components of the water supply system is locatedon the left bank of the Yuzhny Bug river, at a distance of approximately 159 km from its
estuary. From south to north, the territory of the South Ukraine NPP site is crossed by the
Tashlyk water reservoir. From north-west to south-east the Yuzhny Bug river flows 60 km
through the 30 km area. The nearest main building (unit 1) is 2.7 km from the river bank.
There is no woodland in the NPP area.
The Ulianovka-Mykolayiv primary motor road constructed around the Tashlyk water
reservoir passes at a distance of 1050 m from the South Ukraine NPP site fencing. This
motor road is intended for general use and is closest to the South Ukraine NPP.
The closest railroad station is located at a distance of 2.2 km from the NPP site.
There are no gas or oil pipelines, factories or chemical plants within the 30-km area of theSouth Ukraine NPP.
The town of Yuzhnoukrainsk is located at a distance of 2.5 km from the South Ukraine
NPP. The town of Voznesensk (at a distance of 30 km) and several urban-type settlements
and villages are located within the 30-km area. The nearest big city situated beyond theborders of the 30 km area is the regional center, Mykolayiv, located at a distance of 112 km
from the SUNPP.
There are three WWER-1000 units in operation at the South Ukraine NPP. They are unit 1with V-302 reactor, unit 2 with V-338 reactor and unit 3 with V-320 reactor, with a total
electrical power of 3000 MW.

30

STATE NUCLEAR REGULATORY INSPECTORATE OF UKRAINENATIONAL REPORT ON STRESS TEST RESULTS

1.1.1 SU

Main Characteristics of the Units

1.1.1.1 SU Reactor Facility
Major equipment of South Ukraine NPP unit 1 includes:− water-cooled water-moderated reactor WWER-1000 (V-302);− turbine unit K-1000-60/1500 with side-inlet condensers;− generator TVV-1000-4UZ.
Major equipment of South Ukraine NPP unit 2 includes:− water-cooled water-moderated reactor WWER-1000 (V-338);− turbine unit K-1000-60/1500;− generator TVV-1000-4UZ.
Major equipment of South Ukraine NPP unit 3 includes:− water-cooled water-moderated reactor WWER-1000 (V-320);− turbine unit K-1000-60/3000;− generator TVV-1000-2UZ.
South Ukraine NPP units 1 and 2 are designed to consist of two circuits with water-cooled
water-moderated reactors WWER-1000 (V-302/338 design) operating on thermal neutrons
with pressurized water with an electrical power of 3000 MW. The designs of South Ukraine
units 1 and 2 are similar.

Layout Diagram of WWER-1000/V-320 Main Equipment

Systems and equipment of WWER-1000/V-302/338 provide:− safe and reliable operation of the reactor in all normal operation modes
envisaged by the design;− control of operations and monitoring of major reactor equipment;− integrity of the reactor in all design-basis accidents;− integrity and reliable cooling of fuel assemblies in the reactor core in all operation
modes provided by the design.
The reactor facility of South Ukraine NPP unit 3 is developed according to WWER1000/V-320 standard design and is similar to Zaporizhzhya NPP units 1-6.
Reactor equipment is housed in the pre-stressed leak-tight reinforced-concrete
containment having the shape of a hollow cylinder with a spherical dome and flat bottom.
31

STATE NUCLEAR REGULATORY INSPECTORATE OF UKRAINENATIONAL REPORT ON STRESS TEST RESULTS

1.1.1.2 SU Spent Nuclear Fuel Storage Facilities
The spent fuel assemblies unloaded from the core are stored in racks in the spent fuelpools (SFP). Before placing for storage, the fuel assemblies are subjected to fuel cladding
leak testing. Based on the testing results, a spent fuel assembly is placed either in the rackslots or in a sealed canister. The spent fuel storage system is housed in the reactor
compartment provided with all necessary rooms and equipment to receive and store thespent fuel assemblies.
The SFP of units 1 and 2 is housed in the reactor containment and consists of two
compartments: assembly compartment designed for storage of spent fuel assemblies andthe container compartment provided with a stationary rack and multi-purpose slot that is usedas the area for loading of transport casks with spent fuel assemblies and unloading of a fresh
fuel assembly casing. Dividing the SFP into compartments allows for maintenance in one ofthem while spent fuel assemblies are placed into the other. The SFP is adjacent to thereactor pressure vessel and is connected with it by a refueling channel for transport of fuelassemblies. The pool is equipped with spent fuel storage racks.
The SFP cooldown system is intended for removal of residual heat from spent nuclear fuelstored in the cooling pools.
The SFP is filled with a boric acid solution of at least 16 g/dm3 concentration. Water ineach SFP compartment circulates through the SFP cooldown system that keeps the SFP
water temperature within a permissible limit of no more than 70°С (with the reactor corecompletely unloaded). This value is established to prevent boiling of the cooling water andfuel melting induced by decay heat. In addition, the cooldown system ensures a protective
level of water in the SFP during spent fuel storage and provides radiation protection formaintenance personnel.
In an emergency situation there is a possibility for makeup and fuel cooling in SFP
compartments with a 16 g/dm3 boric acid solution from pumps of the containment spraysystem. In this case makeup and water cooling in SFP proceeds as follows: containment
sump – emergency cooldown heat exchanger – containment spray pump – SFP
compartment – SFP flow through the transport opening to the refueling pool – water flow
through the lower elevation of the containment to the containment sump.
The design of the spent fuel pool of South Ukraine unit 3 is similar to that of Zaporizhzhya
NPP units 1-6.
1.1.2 SU

Description of the Systems for Conduction of Main Safety Functions

Units 1 and 2
The reactor coolant system (RCS) consists of a reactor and four circulation loops, eachconsisting of a steam generator PGV-1000M, main coolant pump (MCP) GTsN-195M, and
RCS piping. Each loop of the primary circuit is divided into “cold” and “hot” legs. The “hot” leg
supplies the coolant from the reactor to the steam generator, while the “cold” leg returns thecoolant from the steam generator to the reactor via the MCP. The design of all loops issimilar, ensuring equal hydraulic resistance of the loops and, thus, equal coolant flow rate.
The MCP system is designed to meet the requirements for prevention of radioactivity release
into the environment. The RCS piping design ensures normal operation of the reactor facility
subjected to earthquake-induced loads reaching the design-basis values, and ensures safe
shutdown and cooling. Thermal expansions of the RCS piping are compensated by moving
the steam generators and MCP that rest on rolling supports. To achieve the main safety goal,
which is to prevent radioactive releases beyond the physical barriers, the design provides forthe following safety functions:− reactivity control;− reactor core cooling;− confinement of radioactive substances within the established boundaries.
These safety functions in compliance with the defense-in-depth principle are inherent in
the WWER design.
32

STATE NUCLEAR REGULATORY INSPECTORATE OF UKRAINENATIONAL REPORT ON STRESS TEST RESULTS

Reactivity Control
Reactivity control and reactor transfer to sub-criticality as well as maintaining the reactor
core sub-critical are ensured through reactivity control systems based on different principles:− system of control rod mechanical movement in the reactor core (reactor power
adjustment and scram – reactor protection system);− boric acid control system to regulate boric acid concentration in the coolant (thesystem is designed to control reactivity related to fuel burnup and transients aswell as to keep the core subcritical in reactor shutdown and transfer to cold
shutdown or hot standby mode).
− The control rods are controlled through the control and protection system (CPS).
Control rods are placed in the uppermost position when the reactor is at nominal
power, except for the control rod CPS. Reactor scram is achieved by insertion of allcontrol rods into the core in the shortest time.
In normal operation, the boron control function rests with the primary makeup and letdown
system.
In emergency modes, there are provisions for the regulation of boric acid concentration in
the primary coolant using safety systems integrated in the ECCS (emergency core coolingsystem):− high-pressure boron injection system (TJ13);− high-pressure injection system (HPIS) (TJ10);− passive ECCS (hydroaccumulators TH51-54);− low-pressure injection system (TH10-30).
Each of the ECCS systems has three trains. The passive ECCS consists of 4hydroaccumulators: with the two supplying water to the reactor upper plenum, and the othertwo to the lower plenum.
Emergency systems are actuated automatically in response to emergency signals, theoperating mode and sequence of actuation and operation depends on the initiating event.
In accidents, the ECCS systems supply the primary circuit with the boron-containing
coolant (thus ensuring the reactor core transfer to subcriticality and maintaining the coresubcritical for a long time after reactor scram) and perform the “core cooling” safety function.
Core Cooling
The key objective of this function is to prevent fuel damage as a result of overheating. For
this purpose, there are heat removal systems and equipment in all operational modes. Heatremoval from the reactor core under WWER normal operation proceeds as follows: reactor
core – primary coolant – steam generator – secondary coolant – ultimate heat sink –atmosphere. During accidents and after reactor shutdown, residual heat is removed in thesame sequence. If steam generators are unavailable for heat removal function, the heat isremoved through the emergency core cooling system (ECCS) and essential service water
system.
Fuel cooling in normal operation and anticipated operational occurrences under primarycircuit integrity
At the first cooldown stage, the heat from the reactor core is removed through thesecondary circuit system. Steam is removed through the steam dump valve to condenser(BRU-K) or the steam dump valve to atmosphere (BRU-A) in case of loss of off-site power or
any other initiating event when BRU-K operation is impossible, as well as through steam
generator safety relief valves in case both BRU-K and BRU-A are unavailable. When watersupply to steam generators through the main and auxiliary feedwater systems is impossible,
feedwater is supplied by the emergency feedwater system. In normal operation, small
primary leaks are compensated by the makeup and letdown system. In case of LOCA which
can not be compensated by the make-up system, ECCS systems (HPIS, LPIS and33

STATE NUCLEAR REGULATORY INSPECTORATE OF UKRAINENATIONAL REPORT ON STRESS TEST RESULTS

hydroaccumulators) are used for supplying borated water to the reactor for residual heatremoval under accident conditions.
Limitation of Radioactivity Release
This safety function is aimed at preventing radioactive releases beyond the nuclear power
plant site.
In accidents, fuel can be damaged due to overheating and thus radioactive substances
will release into the primary circuit. In case of loss-of-coolant accident, the containment
prevents the radioactive release into the environment.
To limit radioactivity releases in accidents, the design provides for localization safetysystem, which are systems (components) designed to prevent or limit release of radioactive
materials and ionizing radiation beyond the boundaries specified in the design.
Safety Systems
The safety systems are designed to perform safety functions in case of an initiating event
and any independent single failure of one active or passive component with mechanicalmoving parts, or an additional human error.
All NPP safety systems are designed according to the redundancy principle. Each safetysystem consists of three independent trains. Each train in terms of its efficiency, responsetime and other factors is sufficient to perform the intended functions in the full scope definedfor a given system under any operational mode, including maximum design-basis accident(double-ended break of the main coolant piping DN 850 mm under loss of of-site power).
Independence of each safety system trains is ensured by complete physical separation of
the trains. Equipment of the respective safety system trains is actuated automatically inresponse to independent signals.
WWER-1000/V-302 Major Safety Systems and Their Functions
SystemHigh-pressure Injection
SystemLow-pressure Injection
SystemPassive ECCS
(ECCShydroaccumulators)
Primary Overpressure
Protection System

Intended Use under
Intended Use in Emergencies
Normal Operation
Protective Safety Systems
Standby mode
Supply boric acid solution is to the primary circuit at a
3
3
flow rate of 6 m /h, concentration of 40 g/dm , at2
pressure (160-0 kg/cm ) ranging 16.0-0 MPa
Supply boric acid solution to the primary circuit with a3
flow rate of not less than 130 m /h and initial3
concentration of 40 g/dm , within the range of primary2pressures (110-15 kgf/cm ) of 11-1.5 MPa from a 150
3
m tank, and then, after its emptying, supply boric
3
solution with a concentration of 16 g/dm from tanks
3
V=750 mMaintain temperature of the supplied water not lower
than 20°С in all modes
In emergencies, supply boric solution from the highpressure injection pump, at the latest in 35-40 sec once2
the primary pressure has reached 90 kgf/cm
Residual heat removal
Emergency core cooling and residual heat removalfrom the reactor core andfrom the reactor core in accidents requiring the reactor
primary circuit cooldown.
transfer into “cold shutdown” mode.
Initiated when ECCS protection setpoints are
generated or under loss of power to auxiliary buses on
the automatic load sequencer signal.
3
Under normal operation,
The systems ensures injection of boric acid of 16g/dm
the system is in standby;
concentration and 55-60°С temperature into reactor2
the system is periodicallyunder primary pressure below 5.9 MPa (60 kgf/cm )tested in compliance withthus ensuring core cooling and filling under loss ofthe operating procedures
coolant accidents.
Standby mode: pilotTo prevent RCS damage in pressure increase beyond
operated and main valves the safe operation limits.
are closed and are readyTo decrease primary pressure to ensure the feed andto actuate from all control
bleed procedure by means of the high-pressurelines in case of needinjection system.

34

STATE NUCLEAR REGULATORY INSPECTORATE OF UKRAINENATIONAL REPORT ON STRESS TEST RESULTS
SystemSecondary Overpressure
Protection System:
SG Safety Valves

Steam Dump Valve to
Atmosphere

Intended Use under
Normal Operation
Standby mode

Steam Dump Valve to
Atmosphere RA1343S02 (BRU-А) is
designed for removal ofresidual heat from thereactor; for cooldown of
the primary circuit in thesteam mode; for controlof SG pressure in case of
BRU-K failure or
prohibition for opening

Emergency Gas
Evacuation System

Control & Protection
System (CPS)(mechanical side)
Main Steam Isolation
Valve System

Emergency Feedwater
SystemControl and Protection
System (CPS)
Control Safety System(CSS)

During unit startup thesystemensuresgas
evacuation when the
primary circuit is filling
When reactor is at
nominalpower,
thesystem is not used and ismaintained available.
During unit shutdown, thesystem ensures that the
primary equipment metal
is cooled evenly (reactor
head, SG headerspressurizer upper head)
Compensate for thereactivity changes andreactor power control

Intended Use in Emergencies
Secondary system overpressure protection in
operational occurrences and emergencies.

Protection of the secondary circuit against
overpressure in anticipated operational occurrencesand emergencies

The system ensures complete filling of the core with
coolant for reliable heat removal due to gas bubbles in
the upper dead-end sections of the primary piping that
release from the coolant when its temperature
decreases to saturation margin in case of emergencypressure decrease above the core.
Primary pressure decrease to restore conditions
permitting actuation of high-pressure injection system
pumps.

Reactor emergency power decrease or reactor scramby the reactor control and protection system (CPS)

In standby.

The system is designed to disconnect the emergency
steam generator with broken steam line in non-isolated
section (before MSIV) from steam lines of serviceable
steam generators to limit deep cooldown of the primarycircuit due to additional steam makeup: measure toprevent development of a reactivity accident
In standby.
Emergency feedwater system (EFS) actuated in caseof failure of the normal SG feedwater system. The EFS
is actuated automatically for residual heat removal at
the first stage of emergency cooldown.
Control Safety Systems
Reactor control during
Reactor control during accidents. Emergency reactor
startup, operation at
unloading or reactor scram by the emergency
nominal power and inprotection system.
shutdown states
In standby until actuation
Actuation of safety systems, their control andsignal is received,
monitoring during performance of safety functions.
generates data onprocess parameters to be
used by personnel andactuates alarms whenmajor failures occur.

35

STATE NUCLEAR REGULATORY INSPECTORATE OF UKRAINENATIONAL REPORT ON STRESS TEST RESULTS

Containment System

Containment spraysystemContainment Hydrogen
Measurement System,
passive catalytichydrogen recombiners
Emergency Power Supply
SystemEssential Power
Supply System

Essential Service Water
SystemLocalization safety system
Under normal operation,
Limitation of radioactive releases into the atmospherethe containment systemin emergencies and design-basis accidents including
performs functions of a
maximum design-basis accident
normal operation system,
which include provision of
a closed space to confine
radioactive fission
products released during
NPP operation undervarious design modes.
Standby mode
Accident confinement by condensation of steam
generated as a result of primary coolant leak into thecontainment. Pressure decrease in the containment.
Immobilization of iodine in the steam and air of thecontainment.
Makeup and cooling of spent nuclear fuel in the spent
fuel pool.
In standby.
The hydrogen concentration reduction in thecontainment air to the non-explosive value in designbasis accidents.
Supporting Safety Systems
Independent emergency supply to safety systems.
In emergency modes requiring the operation of safetysystems, the diesel generators are actuatedautomatically and sequentially loaded.
Power supply from thePower supply to all safety system equipment.
working transformer bus
through two bus switcheson 6 kV bus and 6/0.4
transformers of thesecond reliability group.
Power supply toequipment fed from the
0.4 kV essential power
supply bus, first reliability
group. Power supply tothe uninterruptible power
supply unit (UPS) of thedirect-current board andcharging of the battery.
Heat removal to theHeat removal from the reactor core through the ECCS
ultimate heat sink fromheat exchangers, cooling of safety systems’
normal operation systemmechanisms.
equipment (spent fuelpool, intermediate circuit,ventilation systems …),
as well as from safetysystem mechanisms.
In standby.

Unit 3The configuration of the main safety systems and normal operation systems important tosafety of South Ukraine unit 3 is similar to that of Zaporizhzhya NPP units 1-6. The systems
that perform safety functions for WWER-1000/320 are described in Section 1.1.2 Z.
However, the design of unit 3 additionally provides for a common-unit reliable power
supply system including two trains with independent diesel generators and batteries. The
power of each diesel generator (5600 MW) was selected to ensure its startup in case of
blackout of both power units (in case one of the diesel generators fails).
As additional capability that can be used in case of emergencies, additional makeup of
emergency feedwater tanks was introduced at South Ukraine units 1, 2 and 3 from a fire
water collector through the feedwater piping to maintain SG emergency make-up in case oftransfer of design-basis accidents into beyond-design basis scenarios leading to full loss of36

STATE NUCLEAR REGULATORY INSPECTORATE OF UKRAINENATIONAL REPORT ON STRESS TEST RESULTS

water in emergency feedwater tanks and condensate storage tanks, prior to operation of lowpressure injection system (LPIS).
The following power supply options are also ensured at South Ukraine NPP units 1, 2 and3 in case of blackout:− power supply from the available units of the NPP site;− power supply to 6 kV standby lines from diesel generators of any safety systemof any power unit on the site or from the common-unit emergency diesel
generators (for unit 3);− power supply from the Kremenchuk Hydroelectric Plant and Tashlyk
Hydroelectric Pumped Storage Power Plant.
1.2 SU Significant Difference between UnitsSouth Ukraine NPP units 1 and 2 are of identical design and have similar reactor facilities,
layout and arrangement and have no significant differences that may affect assessment of
their vulnerability to extreme external natural events, performance of safety functions orsevere accident management.
There are some differences between the units in terms of safety improvement measures:some measures implemented at one unit are either in progress or planned for future at theother unit.
Taking into account objectives of stress tests, a list of differences between all South
Ukraine NPP units was made. These differences were taken into account during stress tests
at the South Ukraine NPP.
In addition to the differences between the designs of V-302/338 and V-320 containments,
the absence of the main gate valve in the V-320 reactor and the presence of the commonunit emergency diesel generators (unit 3), the following differences were taken into accountduring stress tests of the South Ukraine NPP:
DifferenceType of PRZ PORVType of SG PORVPower Unit 1
Sempell,VS99/66 type
"Bopp&Reuther", SiZ
2507 type

Power Unit 2"Bopp&Reuther",
SiH 3111/3115 type
Chekhov PowerEngineering
Machine-Building
Plant (Russia), 696250/300-0-01 type

Power Unit 3
Sempell,VS99/66 type
"Bopp&Reuther",SiZ 2507 type

1.3 SU Use of PSA as Part of Safety Assessment
Information on PSAs for South Ukraine NPP units 1-3 is provided in Section 1 "General
Data on the Sites and Nuclear Power Plants of Ukraine”.

37

STATE NUCLEAR REGULATORY INSPECTORATE OF UKRAINENATIONAL REPORT ON STRESS TEST RESULTS

2. EARTHQUAKES
2.1
2.1.1

Design Basis
Earthquake against Which the Plants Are Designed

The siting and design of all operating nuclear power plants in Ukraine were performed in
the mid-1970s to meet the regulatory requirements in force at that time. Later, taking into
account national and international experience and IAEA recommendations, the regulatory
framework was improved and a number of new regulations were implemented. In particular,
two levels of earthquakes were introduced (design earthquake and maximum calculated
earthquake) and also seismic categorization of structures, systems and components (SSCs),
specific requirements for SSCs (depending on their seismic categories), requirements forseismic investigations of sites etc.
According to the design documentation, the seismicity of all operating Ukrainian NPP sites
was specified as follows:
Design Earthquake1 (DE) – intensity of 5 according to the MSK-64 seismic scale withprobability of being exceeded of 1x10-2 and peak ground acceleration (PGA) of 0.025 g;
Maximum Calculated Earthquake2 (MCE) – intensity of 6 according to MSK-64 withprobability of being exceeded of 1x10-4 and PGA=0.05 g.
In seismic assessment of SSCs at the design stage, the calculated accelerograms andresponse spectra were used. Depending on site-specific soil conditions, the accelerograms
were revised in terms of site peak ground acceleration (PGA).
Seismic analysis of SSCs was carried in accordance with their categorization. SSCs ofseismic category I are designed to withstand MCE and must perform their functions toensure plant safety during and after MCE. SSCs assigned to seismic category II are
designed to withstand DE impact and must be operable after DE. SSC seismic categorization
is presented in the corresponding sections of the safety analysis reports.
According to regulations, civil NPP structures and buildings are classified into three
categories (I, II, III) depending on their responsibility for nuclear and radiation safety.
Category I3 structures are required to withstand a series of extreme hazards such as snow,
wind, temperature, tornado, maximum design-basis accident and MCE.
In assessment of SSCs, the simultaneous seismic load of three components wasconsidered (two horizontal components and a vertical one), the vertical component was
taken with a factor of 0.5 relative to a horizontal one.
In seismic assessment of equipment and piping, a combination of normal operation andoperating design earthquake (normal operation + DE) and a combination of normal operationand safe shutdown earthquake (normal operation + MCE) were considered, and a joint
impact of MCE and the most unfavorable accident involving piping rupture was taken into
account.
Seismic loads on equipment and its components were calculated for MCE using
accelerograms determined in calculations for equipment mounting elevations. Seismic loads
were calculated using two methods: spectral and dynamic. Floor response spectra, inparticular for the unified design, were calculated for a 1% damping. The considered
equipment was represented as a three-dimensional stick system with discrete mass
distribution. The rigidity of the stick system simulates stiffness properties of equipment andits supports.
1

MCE corresponds to Seismic Level 2 (SL-2) in IAEA practice and Safe Shutdown Earthquake (SSE) in USA practice
DE corresponds to Seismic Level 1 (SL-1) in IAEA practice and Operating Basis Earthquake (OBE) in USA practice3
Category I includes buildings and structures whose destruction or damage can affect safety-related operation systems andthus cause radioactive releases in amounts that may lead to exposure of personnel and the public to radiation exceeding theestablished doses for the maximum design-basis accident or cause failure of safety systems that maintain the reactor coresubcriticality, ensure reactor heat removal and confine radioactive materials
2

38

STATE NUCLEAR REGULATORY INSPECTORATE OF UKRAINENATIONAL REPORT ON STRESS TEST RESULTS

In accordance with IAEA recommendations and state-of-the art international practice, tospecify the seismic hazards of Ukrainian NPPs sites, additional instrumental seismic
investigations were conducted:− 1999-2001 - Khmelnitsky NPP and Rivne NPP sites;− 2009-2010 - South Ukraine NPP site;− starting from 2011 – seismic investigations at the Zaporizhzhya NPP are ongoing.
The additional investigations showed that PGA and calculated accelerograms establishedin the design were specified. The summary of the investigations is presented below.
Seismicity of the sites of operating power units

SUNPP-3

Intensity

PGA

Intensity

PGA

Intensity

PGA
5

0,025

-

-

-

-

≈0,06
6
≈0,093/0,124

50,5 *SSE

6

0,05 5

Seismicity based on
additional investigations
MCE
DE

PGA

6

0,5*SSESUNPP 1-2

V-320
V-320
V-213
V-320
V-302/
338
V-320

0,05÷0,06

ZNPP 1-6
KhNPP 1-2
RNPP 1-2
RNPP 3-4

TypeofreactorIntensity

Power unit

Design seismicity of the
site
MCE
DE

Seismic PSAs for operating Ukrainian power units are currently developed under the“Comprehensive (Integrated) Safety Improvement Program for Ukrainian NPPs”.
2.1.2 Provisions to Protect the Plants against the Design Basis Earthquake
2.1.2.1 Identification of Structures, Systems and Components
In accordance with Ukrainian regulations, the seismic resistance of SSCs is assessedconsidering their seismic categorization.
The list of systems performing safety functions is defined in the design documents andsafety analysis reports. These systems include:− reactor scram system;− high-pressure injection system;− low-pressure injection system;− ECCS hydroaccumulators;− primary makeup and letdown system;− primary overpressure protection system;− primary steam-gas mixture removal system;− SG emergency feedwater system;− auxiliary feedwater system;− secondary overpressure protection system;− containment spray system;− isolation valve system;− essential service water supply system;− auxiliary power supply system;− common-unit reliable power supply system;− air-conditioning and ventilation systems.
4

The additional seismic investigations demonstrated that PGA for SUNPP site is 0.093g, but SNRIU Board madea decision on 8 September 2011 to establish an engineering margin of 30% of PGA=0.093g for seismic
assessments of SSCs, i.e. PGA= 0.12g is accepted.

39

STATE NUCLEAR REGULATORY INSPECTORATE OF UKRAINENATIONAL REPORT ON STRESS TEST RESULTS

Seismic resistance of buildings and structures which contain equipment and piping of theabove-mentioned systems has been analyzed as well.
The list of the mentioned buildings and structures subjected to analysis within theframework of stress tests includes:
For WWER-1000/V-320:− Main building. Reactor building including the auxiliary building;− Main building. Turbine hall;− Building of emergency diesel generators;− Building of common-unit emergency diesel generators;− Auxiliary building ventilation stack (considered in terms of consequences of its damage
and drop on the neighboring building, blocking of access roads etc.);− Auxiliary building. Fresh fuel storage;− Boron solution storage building;− Spray ponds (essential service water system).
For WWER-1000/V-302, 338r:− Main building. Reactor building;− Main building. Turbine hall;− Boron solution storage building;− Building of emergency diesel generators;− Special building. Fresh fuel storage;− Special building ventilation stack;− Mechanical-draft tower (essential service water system).
For WWER-440/V-213:− Main building. Reactor building;− Main building. Turbine hall;− Main building. Fresh fuel storage;− Special building. Ventilation stack;− Building of emergency diesel generators;− Cooling towers (essential service water system).
2.1.2.2 Evaluation of Robustness of Structures, Systems and Components toAssess Potential Margins
To assess the impact of earthquakes on the main safety functions, seismic loads withpeak ground accelerations of 0.05g, 0.1g, 0.15 g, and 0.2 g were analyzed in the frameworkof stress tests.
To assess the threshold effects of earthquakes on safety-related equipment, the seismic
qualification results for Ukrainian NPP equipment were used. The seismic qualification was
intended to confirm seismic resistance of equipment and its ability to perform the main safetyfunctions.
The stress test results for the Ukrainian NPPs confirmed that the safety-related equipment
is capable of performing its main safety functions under design-basis seismic impacts.
The piping required for emergency shutdown, heat removal and confining of radioactive
materials within the specified boundaries for all types of reactors retains its safety functions
during design-basis earthquake.
The structures of category I (containment, reactor building, building of emergency diesel
generators, essential service water spray ponds) and category 2 (including turbine hall) areresistant to the design-basis seismic impacts.
Safety margins with respect to seismic impacts determined during the stress tests areprovided in Section 2.2.1 of this Report.

40

STATE NUCLEAR REGULATORY INSPECTORATE OF UKRAINENATIONAL REPORT ON STRESS TEST RESULTS

2.1.2.3 Main operating contingencies in case of damage that could be caused by anearthquake
In the framework of the stress tests, potential secondary effects of earthquakes wereanalyzed. The consequences of earthquakes that are common for all NPP sites (fire,
explosion, loss of off-site power supply) and specific for each site were identified.
Secondary earthquake effects that may be observed at each site are as follows:− fires and/or explosions at fire hazardous and highly explosive facilities located at
the NPP site (considered in Section 4 of this Report);− loss of off-site power supply (considered in Section 5.1 of this Report);− destructions at the NPP site and infrastructure around the plant (it should be
noted that inspections of each NPP have demonstrated that there is no potential
for significant damage that would block access to the site and buildings of
categories I and II under external hazards);− damage of hydraulic structures at or near the NPP site;− damage of tanks containing various chemicals.
The consequences of secondary effects may be site-specific. In particular, specificconsequences of secondary effects for the Zaporizhzhya NPP site may be as follows:− loss of the ultimate heat sink due to damage of the dam of the Kakhovka
Hydroelectric Plant and, as a consequence, loss of Zaporizhzhya NPP coolingpond (discussed in detail in Section 5.2 of this Report);− potential flooding of the Zaporizhzhya NPP site due to accidents at Dnieper dams
(considered in Section 3 Z of this Report);− destruction of the ammonia tank in the joint auxiliary building, it is not dangerous
since the isolation area exceeds the distance to the ventilation systems of thereactor building.
For the Rivne NPP and Khmelnitsky NPP sites, specific consequences of secondary
effects may be as follows:− leak of chlorine gas resulting from damage of chlorine piping inside thewarehouse and chlorinators during an earthquake with an intensity higher than 6.
Spread of chlorine is dangerous for personnel of the main control room andemergency control room and thus may affect accident management. Measuresare envisaged to ensure survivability of the main control room and emergency
control room (see Section 6.1.3 of this Report).
− flooding of the site resulting from the break of water storage dams is notdangerous. A considerable distance from the water reservoirs to the Rivne NPP
water intake, small amount of water in them, and sufficiently wide floodplain of
the Styr river were considered for the Rivne NPP. For the Khmelnitsky NPP, onsite structures are located substantially above the maximum flooding wave
horizon (considered in detail in Sections 3 R and 3 Kh of this Report).
For the South Ukraine NPP, specific consequences of secondary effects may be leaks
and destruction of tanks with chemicals (nitric and sulfuric acid, etc.). These events are notdangerous since the isolation area exceeds the distance to the air intake of ventilation
systems of the reactor building.
External floods resulting from accidents at hydraulic structures caused by an earthquake
are not hazardous for buildings and structures (considered in detail in Section 3 SU of thisReport).
2.1.3

Compliance of the Plant with Its Current Licensing Basis

The NPP compliance with licensing requirements means mandatory compliance withstandards, rules and regulations on nuclear energy and radiation safety, as well as operating
regulations and procedures.
41

STATE NUCLEAR REGULATORY INSPECTORATE OF UKRAINENATIONAL REPORT ON STRESS TEST RESULTS

To confirm that safety-related SSCs meet the requirements for resistance to external
hazards, maintenance and inspections are conducted on a regular basis in accordance with
operating procedures. Inspections are conducted on a regular basis both by proper
supervisory plant services and by SNRIU inspectors.
NPP maintenance and repair are conducted in accordance with regulatory requirements
and operating procedures to restore operability and keep equipment and systems operable
within the lifetime established by the design. For this purpose, regular maintenance andrepair of systems and equipment are conducted after NPP commissioning to prevent
decrease in their reliability resulting from aging, wear and other operational factors.
For repairs, each NPP provides for relevant divisions (departments, services, laboratories,
workshops and sections, including specialized ones), which constitute the NPP maintenanceand repair service.
The maintenance and repair operations include:− well-arranged and documented maintenance of equipment;− lifetime analysis of components and equipment to determine technically andeconomically sound standards;− analysis of operating experience and determination of the optimal periodicity for
major, intermediate and routine repairs;− implementation of advanced methods for arrangement and management of
repairs;− quality assurance of repairs using appropriate instrumentation;− logistics planning for timely provision of materials, spare parts and componentry
including their quality control.
The requirements for arrangement and documentation of maintenance and repair of NPP
equipment are established in appropriate industrial standards. The procedure for equipment
outage, repair and acceptance and quality inspection after repair is determined in appropriate
procedures.
In addition to maintenance and repair of equipment and piping, regular monitoring of civil
structures is carried out by each NPP. The monitoring of civil structures covers routine
observations, management and control, technical assessments, analysis of processes, timely
detection of changes in load-bearing capability and serviceability, as well as lifetime
reassignment. NPP civil structures and buildings forming a comprehensive production
system are subjected to monitoring.
The monitoring is arranged as follows:− monitoring is carried out permanently in accordance with schedules for technical,
visual and instrumental inspections;− databases (electronic and paper) and technical certificates of buildings andstructures are kept.
Monitoring is based on the technical supervision system including different types ofinspections (with various periodicities) depending on the necessity. To arrange and conduct
monitoring, operating services for buildings and structures are established at each NPP.
Technical inspections conducted to check the state and repair of NPP industrial buildings
and structures are scheduled on a planned basis (according to annual plans for technicalinspections) and include:− visual technical examinations;− instrumental inspections and examinations.
Final and intermediate reports are developed to record monitoring results. These reports
provide the basis for making conclusions on the technical state and lifetime of buildings andstructures.
The results of inspections and examinations confirmed that no buildings or structures
were found in emergency state at all NPPs. Maintenance and repairs, testing and inspections
42

STATE NUCLEAR REGULATORY INSPECTORATE OF UKRAINENATIONAL REPORT ON STRESS TEST RESULTS

conducted on a regular basis in accordance with regulatory requirements and operational
documents allow timely detection and eliminations of drawbacks. This, eventually, confirms
the capability of safety-related SSCs to fulfill their functions.
2.2
2.2.1

Evaluation of Safety Margins
Range of Earthquake Leading to Severe Nuclear Fuel Damage

Ukrainian NPPs operate nuclear fuel manufactured by TVEL Ltd (Russian Federation) andby Westinghouse (USA).
According to the design data, TVEL fuel retains its functions under the following seismic
impacts: 1.6 g in horizontal direction; 2.6 g in vertical upward direction and 1.13 g in vertical
downward direction. According to the design data, the Westinghouse fuel retains its functions
under an axial impact up to 4g and a transverse impact up to 6g. Therefore, the nuclear fuelis designed to withstand loads greatly exceeding the seismic loads for fuel assemblies in the
core.
Nuclear fuel damage may be caused by loss of coolant and failure of heat removal
resulting from damage of primary equipment and piping. In particular, according to the design
data, the WWER-1000/320 was designed to withstand seismic loads up to MCE of 8
intensity. A combination of the maximum design-basis accident and MCE is selected as theboundary case in the design, and the capability of the reactor pressure vessel to retain its
function in these conditions has been verified.
Additionally, it should be noted that analysis of design documentation has demonstrated
safety margins for a great number of pipes and steam lines under impacts of at least 0.1g.
For instance, the main coolant piping and piping of the passive part of ECCS of V-320 are
capable of resisting earthquakes with 0.2g ground acceleration, which substantially exceeds
the design values. Performance of the safety functions under impacts with 0.1g groundacceleration is ensured by the pressure control system piping, SG main steam system piping
and SG feedwater piping.
According to the design documentation for V-302/338 and V-213 reactors, their processequipment and piping (reactor, steam generators, main coolant pump scroll, pressurizer,
relief tank, main coolant piping, ECCS piping, etc.), as well as equipment and piping of thereactor protection and control system, ECCS, primary pressure control system, SG
emergency feedwater system, and secondary overpressure protection system, are capableof performing their safety functions under seismic impacts up to 0.1g; i.e. there is a margin
relative to the design-basis impact (0.05g).
In the framework of technical assessment and long-term operation measures for South
Ukraine NPP unit 1 (V-302), seismic resistance of the primary coolant piping and pressurizer
surge line was calculated. The results of calculations confirmed the seismic resistance of
these components for earthquakes with 0.1g ground acceleration and, correspondingly, theircapability to perform basic safety functions (calculation results for South Ukraine NPP unit 1
can be applied to South Ukraine NPP unit 2 as well in the frames of stress tests). The
resistance to seismic impacts of 0.15g has been confirmed with appropriate strength
calculations for the steam and feedwater lines of South Ukraine NPP unit 1 (V-302), provided
that compensatory measures are taken.
Based on assumptions made in the stress tests, quite a large amount of WWER-1000
safety-related equipment is resistant to seismic impacts of 0.1-0.2g. It should be noted thatthe operating organization (NNEGC Energoatom) currently continues seismic qualification(0.1g PGA) of safety-related equipment at the Zaporizhzhya, Khmelnitsky, Rivne and South
Ukraine NPPs (these efforts include identification of the current state of equipment
qualification, replacement of non-qualified equipment by seismically-resistant one or
implementation of compensatory measures to increase seismic resistance).
Buildings and structures of all NPP units of category I (containment, reactor building,building of emergency diesel generators, and spray ponds of essential service water system)
are resistant to seismic impacts of 0.1g.
43STATE NUCLEAR REGULATORY INSPECTORATE OF UKRAINENATIONAL REPORT ON STRESS TEST RESULTS

To assess the threshold values of seismic impacts on the spent fuel pools and dry storage
facility (Zaporizhzhya NPP), 0.1g ground acceleration was accepted during the stress tests.
The results of analysis demonstrate the following:− structures and components of the fuel storage pools of Ukrainian NPPs retain
their functions under seismic impacts at the level of 0.1g ground acceleration;− structures and components of the dry spent fuel storage facility are designed towithstand 0.2g ground acceleration and perform their functions under this seismic
impact.
2.2.2

Range of Earthquake Leading to Loss of Containment Integrity

In the frameworks of stress tests, V-320, 302 and 338 reactor containments as well as V213 reactor containment were analyzed to assess the seismic impact that could lead to lossof their integrity.
According to design documentation, the seismic resistance of WWER-1000/V-320
containment is maintained at least for 0.1g PGA.
Under stress tests, additional calculations were performed to evaluate seismic resistanceof the V-320 and V-302 containments. The seismic resistance of the V-213 containment wasassessed in 2010 in the framework of long-term operation measures at Rivne NPP units 1
and 2.
The results of preliminary calculations performed under stress tests demonstrate thefollowing.
WWER-1000/V-320
To determine the threshold value at which the V-320 containment remains integral,preliminary containment calculations were performed.

Calculation Model for the V-320 Reactor Containment
The following loads were addressed:− deadweight of structures;− weight of equipment;− polar crane;− preliminary containment compression with tendons;− 7, 8, 9-point seismic intensities;− combination of loads.
The containment foundation is considered to be elastic to characterize its performance
under seismic impacts.
The following results have been obtained in calculations:− mode and frequency of natural oscillations (50 modes considered);− stresses in containment components using a linear-spectral theory of seismic
resistance.
44

STATE NUCLEAR REGULATORY INSPECTORATE OF UKRAINENATIONAL REPORT ON STRESS TEST RESULTS

Containment robustness is assessed for the averaged cross-section without regard tostrengthening at penetrations, etc.
The calculations showed that the threshold value of seismic impact at which the V-320
containment remains integral is at least 0.17g by conservative assessment.
WWER-1000/V-302 (V-338)
Strength calculation of the V-302 reactor containment was performed as part of theseismic assessment. This effort included:− development of a containment finite-element model;− identification of all loads and their combinations in the calculation model,
including seismic loads with intensity of 6 (PGA=0.05g) and PGA of 0.15g (forreinforced-concrete structures, containment pre-stressing system, auxiliary
reactor building, foundation base);− linear calculation for static impacts;− calculation of mode and natural frequency;− calculation of dynamic impacts;− analysis of stresses in the most loaded structural components to assess
compliance of the main supporting structures with operability criteria;− assessment of the containment integrity.
The containment calculation model demonstrates the actual operational conditions andcorresponds to the calculation cases considered. The calculation took into accountinteraction between structural components, spatial performance of structures, mechanicalproperties of materials and grounds and actual tension of containment tendons.

Finite-Element Model for the Containment of South Ukraine NPP Unit 1
Therefore, the V-302 containment is seismically resistant to an earthquake of PGA=0.15g.
WWER-1000/V-213
According to calculations performed in the framework of long-term operation measures,the threshold value of seismic impact for civil structures of units 1 and 2 is not lower than theimpact with peak ground acceleration of 0.185g.

Finite-Element Model for the Reactor Building of Rivne NP Unit 1
45

STATE NUCLEAR REGULATORY INSPECTORATE OF UKRAINENATIONAL REPORT ON STRESS TEST RESULTS

2.2.3 Earthquake Exceeding the Design Basis Earthquake for the Plants andConsequent Flooding Exceeding Design Basis Flood
Zaporizhzhya NPP. An event associated with the breach/destruction of Dnieper dams
located upstream the Zaporizhzhya NPP may represent a potential hazard for this plant. An
assessment has been carried out for the most conservative event, i.e. the avalanche-likebreak of all the said dams, with the Kakhovka Hydroelectric Plant remaining operable(located downstream the Zaporizhzhya NPP). The maximum possible flooding level for sucha scenario will be 19.36 m, which is lower than the level of Zaporizhzhya NPP site (22.0 m).
Hence, there is no direct risk of Zaporizhzhya NPP site flooding in the event of dam
breach/destruction resulting from an earthquake. However, there is a potential for the failureof equipment in the buildings of unit pump stations and spray ponds, which, nonetheless, will
not lead to loss of safety functions.
Khmelnitsky NPP. There are small water reservoirs on the Goryn river at a substantial
distance from the Khmelnitsky NPP site (more than 50 km). Their possible
breach/destruction under seismic impacts cannot pose a hazard to the Khmelnitsky NPP
buildings and structures. The breach of the Khmelnitsky NPP cooling pond does not pose ahazard either, since a breaking wave caused by a seismic impact beyond the design basis
will spread along the Goryn river floodplain in the western direction, considering lowering
ground surface levels. The leveling elevations of the Khmelnitsky NPP site and top of thedam are the same and constitute 206.0 m, while the maximum initial level of the flooding
wave will be 203.0 m. Thus, Khmelnitsky NPP structures are located higher than the
maximum level of the flooding wave.
Rivne NPP. The breach of the water reservoir dam located upstream the river Styr may be
a potential cause of an earthquake-driven flooding of the Rivne NPP. Rivne NPP water
intake structures are the only large hydraulic constructions on the Styr river within the 30 km
area. There are three Styr basin water reservoirs upstream the river at a great distance fromthe Rivne NPP. Considering the substantial distance of these water reservoirs from the Rivne
NPP water intake structures, small amount of water in them, and sufficient width of the Styrriverbed in the area of Rivne NPP water intake (2-3 km), the water level near the Rivne NPP
water intake area will hardly increase (by no more than 0.1 m) in the event of breach of thewater reservoir dams, considering water flow spreading along the riverbed. The analyses andassessments demonstrate that the Rivne NPP site is resistant to external flooding.
South Ukraine NPP. Rise of the water level in the Yuzhny Bug river does not pose ahazard for buildings and structures located on the South Ukraine NPP site since its level (104m) is more than 70 m higher than the water level in the river. Moreover, the South Ukraine
NPP site is 3 km away from the river shoreline. To ensure water cycle, a flood spillway wasarranged in the Tashlyk water reservoir, whereby the water level may reach up to 101.5 m in
the reservoir, which is 2.5 m lower than the leveling elevation of the South Ukraine NPP. Thismeans that there is no risk of flooding for the site.
However, in the framework of stress tests, resistance of the South Ukraine NPP against
external flooding was addressed also in terms of potential flooding of the Tashlyk water
reservoir makeup pump station, which supplies service water from the Yuzhny Bug to theSouth Ukraine NPP. The maximum water levels of the Yuzhny Bug river in the area of thecooling pond makeup pump station constitute 33.0 m. The makeup pump station’s entry levelis 32.407. The Alexandrovka Hydroelectric Plant located within the NPP area allows controlof the river water level and flow, thus excluding the potential for flooding of the makeup pumpstation. Potential failure of the South Ukraine NPP cooling pond makeup pump station will
not result in loss of safety functions.

46

STATE NUCLEAR REGULATORY INSPECTORATE OF UKRAINENATIONAL REPORT ON STRESS TEST RESULTS

2.2.4 Measures Which Can Be Envisaged to Increase Robustness of the Plants
against Earthquakes
The following measures are considered to increase seismic resistance of all operating
NPPs:− complete equipment seismic qualification for 0.1g PGA for the Rivne,
Khmelnitsky, and Zaporizhzhya NPPs and for 0.12g for the South Ukraine NPP,
including replacement of non-qualified equipment by seismic-resistant one or
implementation of compensatory measures to increase the seismic resistance ofequipment;− complete activities to confirm resistance of buildings, structures and piping
against seismic impacts of 0.1g PGA (0.12g for the South Ukraine NPP);− complete additional instrumental seismic investigations at the Zaporizhzhya NPP
site;− implement permanent seismic monitoring systems at all Ukrainian NPPs;− develop a seismic PSA for all Ukrainian NPPs.
The above-mentioned measures are envisaged by the current “Comprehensive(Integrated) Safety Improvement Program for Ukrainian NPPs”.

47

STATE NUCLEAR REGULATORY INSPECTORATE OF UKRAINENATIONAL REPORT ON STRESS TEST RESULTS

3. FLOODING
3 Z FLOODING (ZAPORIZHZHYA NPP SITE)
3.1 Z

Design Basis

The Zaporizhzhya NPP water supply system includes the following main hydraulicstructures: a cooling pond, spray ponds No. 1 and 2, discharge channel of the cooling pond
makeup, blowdown channel and unit pump stations. The Kakhovka Water Reservoir on the
Dnipro River is a source of service water supply for the Zaporizhzhya NPP. In the area ofZaporizhzhya NPP, the reservoir is 8-13 km wide, has an average depth of 8 km and the
maximum depth of 14-16 km (in the bed of the Konka river and Dnipro river).
The cooling pond was made by separating the riverside part of the Kakhovka Reservoir bymeans of a hydraulic-fill sand dam. Non-recoverable losses in the cooling system during
operation are compensated by makeup from the discharge channel of the Zaporizhzhya
Thermal Power Plant (ZTPP). One of the main tasks of the service water pump station is tomake up water losses of the essential service water in case of ZTPP shutdown.
3.1.1 Z Flooding against which the Units Are Designed
The Zaporizhzhya NPP site layout elevation is 22 m. The normal headwater level (NHL) of
the Kakhovka Reservoir is 16.0 m.
From 1958 to 1998, specific watermarks of the reservoir were as follows: an averageannual water mark was 15.6 m, the highest water mark was 16.47 m (in 1969), the lowest
water mark was 12.71 m (in 1960).
Assessment of Zaporizhzhya NPP vulnerability to flooding caused by break of theDnipro Cascade dams
There are large reservoirs of the Kyiv, Kanev, Kremenchug, Dniprodzerzhinsk, Dniprovsk
and Kakhovka Hydroelectric Plants in the Dnipro River basin.
Zaporizhzhya NPP vulnerability to flooding induced by a possible break of the Dniprocascade dams was assessed in the framework of the safety analysis reports. The events
related to the break of the dams were assessed for the most conservative assumption
providing for failure of all Dnipro cascade dams upstream the Zaporizhzhya NPP with the
Kakhovka Hydroelectric Plant dam (located downstream of Zaporizhzhya NPP) remaining
operable. Using a detailed analysis, the maximum possible level in the Kakhovka Reservoir
is determined. It equals 19.36 m, that is below the Zaporizhzhya NPP site elevation of 22.0m.
Kyiv dam

Kremenchug dam
Dniprodzerzhinsk dam

Kakhovka dam

Kanev damDniprovsk dam
Zaporizhzhya NPPLongitudinal Section of the Dnipro Cascade Reservoirs
48

STATE NUCLEAR REGULATORY INSPECTORATE OF UKRAINENATIONAL REPORT ON STRESS TEST RESULTS

To analyze operation of Zaporizhzhya NPP when a breaking wave passes through the
Kakhovka Reservoir, the wave impact can be conditionally divided into several stages
specified by different conditions of the cooling pond filling and emptying and by respective
water level impact on Zaporizhzhya NPP operation.
At the initial stage when NHL in the cooling pond is stable, the NPP structures are innormal operating mode. Afterwards, due to overtopping of both the damp and blowdown
structure, cooling pond water level will rise and exceed the design NHL by 0.20 m. Later, thewater level in the pond will be lowering through the blowdown structure to the design NHL.
While the cooling pond level rises or drops, all NPP structures including the cooling system
for turbine equipment condensers will operate normally. In case of short-term flooding of thedischarge channel of cooling towers (operating in summer) located on the dam, all coolers of
the auxiliary turbine equipment located on the dam must be de-energized.
When the Kakhovka Reservoir water level rises, the ground water level will also increase
within its adjacent areas, specifically, on the dam of the cooling pond up to values
approximating the water level in the reservoir. Therefore, rising ground water level will not beso significant for the structures located on the dam. There will be no additional deformationsof the structure foundations because of a minor change in the ground water level and spray
ponds and unit pump station are protected by drains; moreover, the cooling towers were built
on the pile foundation. At the subsequent stages, the ground water level will decrease tonormal values.
When the cooling pond level rises, the ground water level will also rise in the adjacentareas including the site along the service water supply channel. The ground water level risingby 0.10…0.15 m will cover the 50-80 m area extending from the unit pump stations to themain buildings of all power units. There will be no additional deformations of the structure
foundations and changes in soil filtration parameters of foundation and earthwork structures
because the ground water level changes within the normal deviation range and during ashort period of time.
When the breaking wave passes through the Kakhovka Reservoir, water flow velocities
reach their maximum, the outer side slope of the cooling pond levee is undercut and its
design profile is disrupted.
The analysis of calculations made for Zaporizhzhya NPP cooling pond filling and emptying
when the breaking wave travels through the upstream Dnipro Cascade reservoirs shows thefollowing:− dams of all upstream reservoirs are referred to the first reliability class and aredesigned for snowmelt-induced flood of 0.01% occurrence;− level in the cooling pond can rise up to 16.70 m and exceed NHL value. Such ahigh level can be reached within 6 days;− additional water volume coming to the cooling pond is about 2.0 million m3;− water level in the cooling pond comes down to the design-basis NHL value of
16.50 within 29 days (43 days after the break);− filling and empting of the cooling pond does not affect the power unit safety (sitedesign elevation is 22.0 m, i.e. 2.64 m above the maximum level of the Kakhovka
Reservoir);− in case of overflow to the cooling pond, the turbine service water coolers may fail(cooling towers and spray ponds on the dam are inoperable);− water level will be rising and lowering slowly (with maximum daily variations ofless than 1.0 m/day), that will not affect the structural stability;− wave height equal to h=0.90m in the Kakhovka reservoir was obtained as a resultof calculations made for the north-west direction of wind with a speed of W=17
m/sec (of 50% occurrence) (for the period when the breaking wave passes
through the Kakhovka Reservoir). Wind-induced surge height is expected to beabout 0.02 m, with slope swash of 0.24 m. Wave impacts will cause negligible
49

STATE NUCLEAR REGULATORY INSPECTORATE OF UKRAINENATIONAL REPORT ON STRESS TEST RESULTS

change to the dam slope 5-10 m wide, that actually will not affect the designbasis profile of the dam (crest width of 250-400 m);− when the peak breaking wave passes, the water flow velocity in the Kakhovka
Reservoir will reach 0.82 m/sec. This entails scouring of fine-grained sands of theunfortified outer slide slope of the cooling pond dam. Along the banks, when thewater flow velocity exceeds 0.5 m/sec, scouring of the cooling pond dam by thewater flow will occur, i.e. within 5 days. Washed-down earth will be deposited on
the underwater part of the dam slope. Width of a faulted area of the dam will beless than 10 m;− short-term wave impacts and increased flow velocity in the Kakhovka Reservoir
during snowmelt flood will not result in significant negative influence on
Zaporizhzhya NPP structures and will not affect safety of the Zaporizhzhya NPP.
Possibility of ultimate heat sink loss as a result of hydraulic structure damage after anearthquake
In the framework of stress tests, a possibility of water loss in the Zaporizhzhya NPP
cooling pond induced by the Kakhovka Hydroelectric Plant dam failure after an earthquake
was reviewed.
The lowest water level in the Kakhovka Reservoir on the Zaporizhzhya NPP site will be
10.0 m in case of the break of the Kakhovka Hydroelectric Plant dam. Owing to thesignificant width of the cooling pond levee, the dam will not be broken; and water losses
because of filtering will remain actually unchanged in comparison with the design-basis
conditions (NHL of the pond is 16.5 m, minimum volume level in the Kakhovka reservoir is12.7 m).
Also, a possibility of water outflow from the cooling pond through the blowdown canal isreviewed. This canal is designed for water discharge from the cooling pond to the Kakhovka
Reservoir to improve chemical composition of water in the circulation system. The dam
structure includes a blowdown structure to provide the cooling pond blowdown. The structure
consists of a blowdown canal and water discharge gate. Width of discharge openings is 3.0
m. Discharge channel bottom width is 8.0m. Elevation of the sluiceway structure bottom is13.0 m. Maximum water flow rate passing through the blowdown structure according to thedesign is 40.0 m3/sec.
In place of blowdown structure, backfill of the dam is made using loose earth with layer-tolayer compaction. In case the blowdown structure’s discharge openings are destroyed as aresult of an earthquake, the water discharge gate may be covered with surrounding soils.
A failure of the Kakhovka Hydroelectric Plant dam after an earthquake may lead to loss ofwater in the Zaporizhzhya NPP cooling pond and, consequently, loss of make-up of theessential service water spray ponds.
Assessment of impacts with regard to the Dry Spent Fuel Storage Facility (DSF)
The system of residual heat removal from the spent fuel assemblies in the DSF iscompletely passive (natural convection of atmospheric air). During operation, the personnel
cannot control the heat removal process. The only external factor that can influence theprocess of heat removal from the spent fuel assemblies is the change in atmospheric air
temperature and humidity and deterioration of the air possibility through the ventilation ductsof the VSC-WWER containers (anticipated operational occurrences).
The most vulnerable point of the structure seems to be ventilation apertures of the VSCWWER containers. Blockage of these apertures may occur during flooding since water flow
may carry with it a sufficient amount of aquatic vegetation, silt and waste. Although it is notexpected that DSF can be flooded due to hydrogeological conditions of the Zaporizhzhya
NPP location, hypothetical full blockage of VSC-WWER containers apertures will not be
followed by disastrous consequences and critical increase in fuel temperature.

50

STATE NUCLEAR REGULATORY INSPECTORATE OF UKRAINENATIONAL REPORT ON STRESS TEST RESULTS

3.1.2 Z Provisions to Protect the Units against the Design Basis Flood
According to the design, the territory around the buildings is planned with slope from thebuildings to drain snowmelt and rain waters to the storm-water inlets of storm sewers. The
site territory around the main buildings of reactor compartment has the overall slope to thedirection of the cooling water pond. Therefore, layers of the water which are formed on roads
will flow down a side slope into the cooling water pond. The network operating staff controls
network performance, as well as a storm sewer provides remedial maintenance andcleaning-up in case of clogging or degradation of the discharge capacity.
All the Zaporizhzhya NPP waterside pumps are equipped with drainage pumps to avoid
flooding of the turbine hall. For pumping water from the drainage sumps, all Zaporizhzhya
NPP emergency diesel generators (and common-unit emergency diesel generators) areprovided with water drainage pump systems which operate in automatic mode. Process
alarm is envisaged in the main control room in case of water level rising in drainage sumps ofthe emergency diesel generator building.
The turbine halls of the main buildings, as well as the reactor auxiliary building of “noncontaminated area” on below-zero elevations of staircases, are provided with drainage
sumps of the industrial sewage system, with waste water pumped out by means of drainage
pumps in the automatic mode. The main control room is equipped with a sump overflow
process alarm. If water ingresses into the main building, it will flow down the staircase into
the drainage sump and will be pumped out by drainage pumps.
The Zaporizhzhya hydraulic engineering service monitors the cooling pond water level ona regular basis. In case of emergency on water bodies, the plant management will be
informed, therefore, adequate measures will be taken.
3.1.3 Z Compliance of the Units with Their Current Licensing Basis
Compliance with unit license conditions is discussed in Section 2.1.3.
3.2 Z Evaluation of Safety Margins
3.2.1 Z Estimation of Safety Margin against Flooding
In case of a break of the Dnipro cascade dams, the highest possible level in the Kakhovka
Water Reservoir is 19.36 m, that is below the elevation of Zaporizhzhya NPP site 22.0m. The
rise of Kakhovka Water Reservoir level will not have a direct impact on Zaporizhzhya NPP
units, but some faults in operation of equipment located in the unit pump station may occur,as well as failure in operation of the spray pond located in cooling pond channels.
3.2.2 Z Measures That Can Be Envisaged to Increase Robustness of the Unitsagainst Flooding
To prevent impact of accident consequences on Zaporizhzhya NPP hydraulic engineering
structures, the following actions are planned:− carry out a detailed analysis of the potential water loss of Zaporizhzhya NPP
cooling pond due to the break of the Kakhovka Hydroelectric Plant dam resulting
from an earthquake;− develop additional measures to provide for makeup of the spray pond of theessential service water system.
Despite the absence of direct influence on Zaporizhzhya NPP safety from flooding that
may be caused by a possible break of Dnipro cascade dams, the following activities havebeen implemented at the Zaporizhzhya NPP:
− water pumping circuits in case of flooding of the reactor building or turbine werebeen developed;− a purchase order for additional underwater pumps of high-level performance wasissued;− a list of buildings to be sealed to prevent flooding of the reactor building wasdeveloped;
51

STATE NUCLEAR REGULATORY INSPECTORATE OF UKRAINENATIONAL REPORT ON STRESS TEST RESULTS− activities were completed to seal the rooms at below-zero elevation of the reactor
compartment of units 1 and 2 and emergency diesel generator building;− equipment was manufactured to seal the relief valves in rooms at below-zeroelevations of the reactor compartment; procedure for their use was determined;− procedures were developed to de-energize the equipment of the emergency
control room in case of flooding;− procedures for personnel actions in case of flooding of the reactor building,emergency diesel generator building, turbine hall, unit pump station weredeveloped.
3 KH FLOODING (KHMELNITSKY NPP SITE)
3.1 Kh Design Basis
The source of Khmelnitsky NPP service water supply is Goryn river and Gnyloy Rog river.
The major hydraulic engineering structures consist of:− off-channel cooling reservoir;− earthen water-retaining dam;
− flood spillway;− drainage canal of seepage water draw-off;− pump station of seepage water return;− cooling water intake channel;− unit pump stations;− pre-filter cameras;− pressure and return circulating water lines;− closed outlet channels with siphon structure to maintain water levels in closed
outlet channel;− open outlet channel;− conjugating structures;− pump station of additional water.
Each unit pump station provides water to the appropriate unit. The following basic
technological equipment is located in the unit pump station:− circulation pumps of the main cooling system, supplying water for cooling theturbine equipment in the main building;− non-essential pumps supplying water to the cooling equipment located in thereactor and turbine halls, as well as in the special building;− fire water pumps.
The essential service water system is designed for heat removal from the equipment
important to safety, located in the reactor compartments and emergency diesel generator
building, and for heat transfer to the ultimate heat sink. The essential service water system
performs the following functions:− remove heat from the coolant through the ECCS heat exchangers;− remove heat from the equipment of safety systems;− remove heat from the equipment of normal operation systems important to safety.
The essential service water system combines the functions of the normal operation
system important to safety and the supporting safety system. The system consists of three
independent cooling channels and it is isolated from other cooling systems. Spray ponds are
made for each channel for cooling. The main source of the make-up water system is an
open-pit type pond, where the pump station is located. To maintain the water quality in the
coolant system, additional water is treated at the water purification plant. The reserve
makeup of the system is provided from the nonessential service water system.
3.1.1 Kh

Flooding against which the Units Are Designed

A threshold value of external flooding impact (seasonal floods and flash floods on the
Goryn river and Gnyloy Rog river) is flooding of compartments in the Khmelnitsky NPP
52

STATE NUCLEAR REGULATORY INSPECTORATE OF UKRAINENATIONAL REPORT ON STRESS TEST RESULTS

buildings where safety systems and safety important systems are located. There arecompartments located below a relative building elevation of 0.0. The relative elevation of 0.0
of the main buildings and emergency diesel generator buildings corresponds to an absoluteelevation of 206.15 m. Thus, the threshold value of the external flooding impact is water level
at Khmelnitsky NPP reaching 206.15 m abs.
The relative elevation of 0.0 of unit pump station-1 and unit pump station-2 corresponds toan absolute elevation of 204.5. However, the unit pump stations are isolated from the Goryn
river by the Khmelnitsky NPP territory. Thus, for the unit pump station’s equipment, thethreshold value of the external flooding impact as a result of seasonal floods and flash floods
on the Goryn river is the water level at Khmelnitsky NPP reaching elevation 206.0 abs.,
which corresponds to an elevation of road planning in the vicinity of the main buildings.
The highest level of a spring tide in the Goryn basin over 1946-1999 was observed in
1956: on the Khmelnitsky NPP water intake area near the town of Neteshin, this level
reached an absolute elevation of 195.96. The absolute elevation of the maximum designbasis level in the vicinity of NPP water intake is 197.84 m.
Taking into account floor elevations of the site (206.0 m) and the outdoor switchyard area
(222.0–24.0), the highest water levels induced by snowmelt and rain waters on the Goryn
river do not threaten the NPP structures.
The makeup water pump station of the water reservoir is located at the downstream slopeof the dam. Water is fed to the pump station under gravity through a bypass channel from theGoryn river. The relative elevation of the pump station floor of 0.0 corresponds to theabsolute elevation of 198.0. In the event of seasonal floods, the pump station may be
flooded, however the pump station flooding does not jeopardize functioning of the coolingwater reservoir of the Khmelnitsky NPP and the systems that use this water (the NPP
comprised of two power units can function without charging from the cooling water reservoir
under emergency conditions over a year).
The essential service water makeup pump station is isolated from the cooling water
reservoir by the Khmelnitsky NPP site with a grade level of 206.0. Thus, the water level risein the water reservoir will not have an impact on functioning of the essential service makeup
water pump station.
On the Goryn river, there are some small water reservoirs far away from the Khmelnitsky
NPP (more than 50 km) and their break cannot threaten the Khmelnitsky NPP buildings andstructures.
The break of the dam of the cooling water reservoir do not pose any threat as a breaking
wave in the event of an accident (i.e., as a result of beyond-design-basis seismic effects) will
spread over the Goryn floodplain westward downstream the river considering the lowering ofground levels.
3.1.2 Kh

Provisions to Protect the Units against the Design Basis Flood

Equipment of the systems involved into safe shutdown and maintaining of the reactor
facility under “cold” shutdown conditions is located in the reactor and turbine compartments,
emergency diesel generator building, electrical stack structure, and also includes coolingponds and underground piping.
According to the design, the territory around Khmelnitsky NPP buildings is planned with aslope from the buildings to transfer rain and snowmelt waters into storm sewage system. The
territory of the area next to the main buildings of the reactor compartment is sloped towards
an inlet channel. Therefore, if layers of water form on road passages, water will run down into
the intake channel over the ground slope. The network operating staff controls operability of
networks including the storm water system, conducts maintenance and repairs if necessary,cleans them in case of blockage and deterioration of their discharge capacity.
All the pump stations at the Khmelnitsky NPP are equipped with drain pumps to prevent
turbine hall flooding. For water pumping from drainage sumps, all emergency diesel
generator buildings at the Khmelnitsky NPP are provided with automated drainage systems.
53

STATE NUCLEAR REGULATORY INSPECTORATE OF UKRAINENATIONAL REPORT ON STRESS TEST RESULTS

In case of water level rise in the drainage sumps of the emergency diesel generator building,
process alarm at the main control room is envisaged.
In the turbine compartments of the main buildings at Khmelnitsky NPP unit 1 andKhmelnitsky NPP unit 2, as well as in the reactor auxiliary building of the so-called “clean”
area, drainage sumps of the industrial sewage system are provided at below-zero elevationsof stair cages from which sewage water is drained automatically with drain pumps. The main
control room is equipped with process alarms in case of sump overflowing. In case of water
ingress into the main building rooms, water will run down into the drainage sump and will bedrained with the help of drainage pumps.
3.1.3 Kh Compliance of the Units with Their Current Licensing Basis
Plant compliance with licensing conditions is considered in Section 2.1.3.
3.2 Kh Evaluation of Safety Margins
3.2.1 Kh Estimation of Safety Margins against Flooding
Floor elevations of the dam top and ground level at the Khmelnitsky NPP are 206.0 m
abs., and the maximum initial elevation of a flooding wave in case of breaking of the coolingwater reservoir dam is 203.0 m abs. Thus, structures at the Khmelnitsky NPP site are locatedabove the maximum horizon of the flooding wave.
3.2.2 Kh Measures That Can Be Envisaged to Increase Robustness of the Unitsagainst Flooding
There is no need for developing and implementing additional actions to increase therobustness of the Khmelnitsky NPP against potential external floods.
3 R FLOODING (RIVNE NPP)
3.1 R

Design Basis

Rivne NPP service water supply is provided from the Styr river. Water intake structures
are located on the right bank of the river and consist of a silt-settling tank, intake channel,
additional water pump station and discharge water conduits. The water intake structures
were built as a part of the first construction stage (power units 1-3).
For heat removal from turbine condensers and auxiliary equipment heat-exchangers, theRivne NPP uses cooling towers of 100 000 m3/h capacity each. Spray ponds are used forheat removal from essential loads.
To provide for a scale-free mode, the main cooling system includes additional water
treatment structures. To maintain specific water chemistry, the main cooling system includes
a blowdown system. The essential and non-essential cooling systems are also fed from theStyr river by means of additional water piping. It is envisaged that the blowdown of essential
and non-essential cooling systems is performed by the wind through droplet entrainment ofwater from the spray pond.
The essential service water system of units 1 and 2 is designed to cool down equipmentthat assures nuclear and radiation safety of the units (equipment of the reactor compartment,
emergency diesel generators, turbine compartment equipment involved in unit cooldown).
The essential service water system together with spay ponds is a recycling water system thatis not connected with any other service water systems. This system is shared between units
1 and 2 and is composed of three independent trains. Each train is designed to supply the
maximum design flow in case of main coolant piping break. Each safety system train isprovided with one spray pond. Unit pump station-1 is common for both power units. The
essential service water system must operate in all design-basis modes including emergency
ones.
The essential service water system of power units 3 and 4 is intended for removing heatfrom equipment of the reactor compartment and emergency diesel generator building in
54

STATE NUCLEAR REGULATORY INSPECTORATE OF UKRAINENATIONAL REPORT ON STRESS TEST RESULTS

normal operation and in case of emergencies. The essential service water system is a
recycling system provided with spray ponds as coolers. The system includes three trains,with one spray pond for each train. The system, which is completely isolated from othercooling systems, operates continuously. The design flow rate of cooling water is 9000 m3/h
per unit and 3000 m3/h per train. Essential service water pumps are located in theemergency diesel generator building.
3.1.1 R Flooding against Which the Units Are Designed
The Styr river is the closest surface water body that is also used as Rivne NPP service
water source. The river water level rise primarily affects water intake structures, nearby
structures and, to a lesser extent, structures located far from it.
In designing the Rivne NPP first stage, maximum design water levels were defined forwater intake points of the Styr river. They were also taken into consideration in developing
the design of the second stage of the Rivne NPP. The maximum level of the Styr river in the
Rivne NPP intake area is 164.4 m. From 1947 to 2010, the highest level of a spring tide in
the Styr basin was observed on 9 April 1956: in the Rivne NPP water intake area, this level
reached 163.2 m. Approximately the same high flood level (163.0 m) was observed in 1979.
Since the floor elevation of the NPP site is 188.5 m, it cannot be flooded as a result ofcatastrophic river high floods.
The relative floor elevation of 0.0 m of the additional water pump station located on the
Styr bank corresponds to an absolute elevation of 165.0 m. The absolute design groundelevation near the pump station is 164.85 m. In designing the pump station, the maximum
design water level of the intake channel was taken as 163.8 m. The threshold value which, if
reached, may result in flooding and resulting inoperability of the additional water pumpstation is the Styr water level of 165.0 m.
If the additional water pump station fails and, correspondingly, the plant cooling makeup
systems fail, power units must be shut down. Makeup of the essential service water systemafter reactor shutdown can be provided using water inventory of the spray ponds, intake anddischarge channels of the main circulating water cooling system, and cooling tower ponds.
The total water inventory of the main cooling system structures is 170 000 m3, this volume
will be sufficient for 27 days of plant operation in "cold shutdown" condition.
It should be stressed that emergency procedures and water drain pumps are provided in
the event of flooding of the make up service pumps.
The potential flooding of Rivne NPP may be caused by an accident on hydraulicengineering structures, such as breaking of dams of water reservoirs located upstream theStyr river. Rivne NPP water intake structures are the largest hydraulic engineering structures
constructed on the Styr river. There are no other large hydraulic engineering structures within
the 30-km area of the Rivne NPP.
There are three upstream water reservoirs located in the Styr river basin at a significant
distance from the Rivne NPP. The largest one is the Khrennikovske water reservoir located212 km upstream of the RNPP water intake. The second water reservoir is Mlynovske water
reservoir located approximately at the same distance from the Rivne NPP, on the Ikva river(the right tributary of the Styr river). The Kholonovsk water reservoir is located on the
Bezymyanka river that flows into the Khrennikovske water reservoir.
Considering the long distance of the water reservoirs from the Rivne NPP water intake
structures, their small water inventory and sufficient width of the Styr river floodplain (theKhrennikovske water reservoir that is 0.5 - 0.6 km wide in the downstream wall extends up to
2-3 km towards the Rivne NPP water intake structures), the water levels in the vicinity ofwater intake will not practically rise in case of hypothetical dam break, with the account offlow spreading over the river floodplain.

55

STATE NUCLEAR REGULATORY INSPECTORATE OF UKRAINENATIONAL REPORT ON STRESS TEST RESULTS

3.1.2 R Provisions to Protect the Units against the Design Basis Flood
At present, the state of geological, hydrological and hydrogeological conditions ismonitored at the Rivne NPP site and its 30-km area. These monitoring activities are
conducted using different methods and monitoring facilities. Monitoring activities are
performed by means of the following systems:− surface water quality monitoring and control system;− ground water quality monitoring and control system;− system for monitoring of geological processes and soil conditions.
Hydrological situation on the Styr river is monitored by hydrometric stations of the
Ukrainian Hydrometeorological Committee’s network including those located upstream anddownstream of Rivne NPP water intake (villages of Kolki and Mlynok). Hydrologicalobservations of the Styr river are also performed by the Rivne NPP on the hydrologicalstation located in the town of Kuznetsovsk. In case of dangerous water level rise of the Styrriver that may result in flooding of the additional water pump station, the plant management
will be informed and power units will be shut down if necessary.
The entire territory of the Khmelnitsky NPP site has a common slope spreading from thenorth to south-west, towards the Styr river. Therefore, water layer (if formed) will run downhill
to lower places. In accordance with the design, the territory surrounding the buildings wasplanned with regard for slope to drain rain and snowmelt waters to storm sewage. The
Network Operations Department controls their operability, conducts maintenance and repairs
required, as well as cleanup in case of blockage and deterioration of their discharge capacity(these activities are also performed for the storm sewage system).
Each Rivne NPP emergency diesel generator building is provided with a drain system topump-out water from sumps. Rivne NPP main buildings at below-zero elevations areprovided with drainage sumps of the industrial sewage system from which discharges are
pumped out by drain pumps. In case of water ingress into the main building rooms, it will run
down through stair cages to the drainage sump at elevation minus 3.6 m and will be pumped
out using drain pumps.
3.1.3 R Compliance of the Units with Their Current Licensing Basis
Plant compliance with its licensing basis is considered in Section 2.1.3.
3.2 R

Evaluation of Safety Margins

3.2.1 R Estimation of Safety Margins against Flooding
The design ground elevation of the Rivne NPP site is 188.5 m and for additional water
treatment structures is 188.9 m. Outdoor switchyards of 110 kV and 330 kV are located on
the terrace arranged on the elevation of 192.5 m. The design ground elevation of 750 kV
outdoor switchyards varies in the range of 180.0 m to 179.5 m. The maximum design waterlevel of the Styr river is 164.4 m.
The NPP site is located well above the design water level of the Styr river with no risks of
Rivne NPP flooding induced by an accident at hydraulic engineering structures.
3.2.2 R Measures That Can Be Envisaged to Increase Robustness of the Unitsagainst Flooding
There is no need for developing and implementing additional actions to increase
robustness of the Rivne NPP against potential external floods.
3 SU FLOODING (SOUTH-UKRAINE NPP)
3.1 SU Design Basis
The South Ukraine NPP with all main components of water supply system is located on
the left bank of the Yuzhny Bug river about 159 km from its estuary. The water supply system
includes the following main hydraulic engineering structures: cooling pond, intake channel,
56

STATE NUCLEAR REGULATORY INSPECTORATE OF UKRAINENATIONAL REPORT ON STRESS TEST RESULTS

water makeup and supply pump station, and spillway structures. South Ukraine NPP service
water supply is based on pumped storage constructed on the Tashlyk gorge and is fed fromthe Yuzhny Bug river during operation.
The Yuzhny Bug is situated 4 km to the west of the site. The total length of the river is 806
km, water intake area is 63700m3. The river valley is a canyon 170-350 m wide, with slopesof approximate height of 50 m. There is no floodplain, the right bank is steep and iscomposed of granite, and the left bank is moderately steep, steadily washed out.
There are several hydroelectric plants on the Yuzhny Bug River: Pervomaisk
Hydroelectric Plant with water reservoir capacity of 3.3 mln. m3 and the Aleksandrovka
Hydroelectric Plant with the water reservoir capacity of 134 mln. m3 .
Construction of the Tashlyk Hydroelectric Pumped Storage Plant began in 1981. This
plant is an integral part of the South Ukraine power system that also includes the South
Ukraine Nuclear Power Plant and Aleksandrovka Hydroelectric Plant (small-sized).
According to the design, the Tashlyk Pumped Storage Plant had to consist of six recycling(generator/engine) units 150 MW each in turbine mode (225 in pump mode) and fourordinary hydraulic units 250 MW each. The total installed capacity would be:
6x150+4x250=1600 MW (turbine mode)/ 6x225=1350 MW (pump mode).
3.1.1 SU

Flooding against Which the Units Are Designed

Effect of floods on the Tashlyk stream is considered in terms of potential flooding of theSouth Ukraine NPP site. To characterize water rise levels, long-term observation data fromhydrometric stations located within the South Ukraine NPP site are used.
To arrange for water exchange in the Tashlyk reservoir, flood spillway is provided, throughwhich water is discharged during the flood. Water level in the reservoir may reach a 101.5 m
watermark, that is 2.5 m lower than the design site elevation and, therefore, there is no riskof site flooding.
In case an accident occurs on flood spillway (gate closed) or transmission of discharged
water through spillway is impossible, extreme rain flood volume will be transferred byovertopping (overflow of the crest) of the dam (102.3 m). Short-term wave actions andincreased flow speed in the reservoir during the flood will not affect the NPP structures andsafety of the South Ukraine NPP.
Therefore, a conclusion can be made that Tashlyk stream flood and further water rise in
the Tashlyk reservoir do not jeopardize the safety of South Ukraine NPP buildings andstructures.
The rise of the Yuzhny Bug river level does not pose a direct threat to facilities andstructures located on the NPP site because the design site elevation is 104 m and is morethan 70 m above the river level. Meanwhile, the distance from the Yuzhny Bug bank line to
the South Ukraine NPP site is 3 km. Taking this into consideration, the flooding effects on
facilities and structures located on the NPP site may not be taken into account due to theconsiderable site elevation above the river level.
It should also be noted that, in case of flooding on the makeup pump station andtermination of water blowdown in the Tashlyk water reservoir, the water will be subjected tomineralization. This process is not critical for NPP operation as water reservoir has not beenblown down for several years.
Based on the operating experience of the Tashlyk reservoir makeup pump station, thesystem is to be put in operation no more than once a year. It is obvious that a failure of the
makeup pump station equipment will not lead to undesired consequences for the power unit.
3.1.2 SU

Provisions to Protect the Units against the Design Basis FloodTo prevent turbine hall flooding, all pump stations at the South Ukraine NPP are provided
with drain pumps. For pumping water from drainage sumps, the automated drain water
pumping systems are used at all emergency diesel generator systems. If water level rises in
57

STATE NUCLEAR REGULATORY INSPECTORATE OF UKRAINENATIONAL REPORT ON STRESS TEST RESULTS

drainage sumps of the emergency diesel generator building, the relevant alarm signal isgenerated at the main control room.
The turbine halls of the main buildings and auxiliary building of the reactor compartment in“non-contaminated area” at below-zero elevations of staircases are provided with industrial
sewage system drain sumps from which wastewater is automatically pumped out by drain
pumps. The main control room provides process alarms in case of sump overflowing. If water
ingresses into the main building it will flow down the staircase into the drain sump and will bepumped out by drainage pumps.
South Ukraine NPP information services collect, process and store all corresponding
meteorological and hydrological data in order to assure safety and to avoid any potential
negative effects.
3.1.3 SU

Compliance of the Units with Their Current Licensing Basis

Unit compliance with the licensing conditions is considered in Section 2.1.3.
3.2 SU
3.2.1 SU

Evaluation of Safety Margin
Estimation of Safety Margin against Flooding

The level of the Tashlyk reservoir can reach a 101.5 m watermark, that is 2.5 m lower
than the design site elevation and, therefore, does not pose a risk of site flooding.
The Yuzhny Bug water level rising does not pose a direct threat to facilities and structures
located on the South Ukraine NPP site since the design site elevation is considerably higher
than that of river water.
3.2.2 SU Measures That Can Be Envisaged to Increase Robustness of the Unitsagainst Flooding
There is no need for developing and implementing additional measures to improve theSouth Ukraine NPP robustness against potential external flooding.

58

STATE NUCLEAR REGULATORY INSPECTORATE OF UKRAINENATIONAL REPORT ON STRESS TEST RESULTS

4. EXTREME WEATHER CONDITIONSIn the framework of stress tests, the following external hazards (except for earthquakes
and floods) were analyzed for all operating NPPs:− tornados;− extreme wind;− external fires;− heavy precipitations, extreme snowfall;− extreme temperatures;− different combinations of external hazards.
The stress tests revealed no additional external hazards or their combinations that were
not taken into account in the safety analysis reports.
4.1

Design Basis

Extremely high/low temperatures
The following temperature parameters were used in the design of operating NPPs:
Outside temperature, °С

ZNPP

KhNPP

RNPP

SU NPP

Absolute maximum temperature

+41

+41

+38

+41

Absolute minimum temperature

-34

-36

-38

-36

Long-term data were used to specify the characteristics of climatic conditions:− for the Zaporizhzhya NPP site - data taken from the weather stations ofZaporizhzhya, Nikopol and Prishyb. The Nikopol weather station was selected asa reference one;
− for the Khmelnitsky NPP site – data taken from the Shepetovka weather station;− for the Rivne NPP site – data taken from the Sarny weather station;− for the South Ukraine NPP site – data taken from the Pervomaisk andKonstantinovka weather stations.
Heavy precipitations
In compliance with standards for design of rainwater drain system and industrial storm
sewer systems, the design flow rate of rainwater is determined on the basis of 20-min rainfall
intensity (q20).
For the Zaporizhzhya NPP site, this design criterion constitutes 85 L/sec×ha.
For the Khmelnitsky NPP site, this criterion constitutes 100 L/sec×ha.
For the Rivne NPP site, this criterion constitutes 100 L/sec×ha.
For the South Ukraine NPP site, this criterion constitutes 90 L/sec×ha.
Tornadoes
The standards that were in force at the time the Ukrainian NPPs were designed did not
require to consider tornado impacts. In accordance with new standards and regulations andtaking into account statistics of observations, calculation parameters and characteristics for apotential tornado have been established for Ukrainian NPP sites.
As statistical data are accumulated, tornado characteristics may be specified. Therefore,
the assessment of buildings and structures for tornado impact in safety analysis reports used
more conservative values of tornado loads as compared with calculation ones.
Tornado characteristics represented in the SAR for each site include, in particular, thefollowing parameters:− tornado class;− annual tornado probability;− maximal tornado rotational speed;
59

STATE NUCLEAR REGULATORY INSPECTORATE OF UKRAINENATIONAL REPORT ON STRESS TEST RESULTS− maximal tornado forward speed;− pressure drop between the center and periphery of tornado.
Impact of tornado on buildings and structures is determined by three factors:− wind frontal pressure;− pressure drop (between the tornado center and periphery);− flying missiles.
According to regulatory requirements, tornado impacts must be taken into account forbuildings and structures of category I responsibility for nuclear and radiation safety. They
include: reactor building, building of emergency diesel generators and spray ponds ofessential service water system of group A.
External fires
When mixed (coniferous and hardwood) forests growing on dry soil are on fire, a safe
distance to the facility shall be at least 100 m on the leeward side (according to the wind roseat an average annual wind speed up to 10 m/sec).
4.2

Evaluation of Safety Margins

4.2.1 Estimation of Safety Margin against Extreme Weather Conditions
Extremely high/low temperatures
Long-term observations at the operating NPP sites were used to obtain the following
temperature parameters:
Outside temperature, °С

ZNPP

KhNPP

RNPP

SU NPP

Maximum temperature

+39*

+36,6

+37,8

+39

Low temperature

-34

-33,6

-36,9

-34

*The maximum temperature measured by the Nikopol weather station was up to +39°С and by the
Zaporizhzhya weather station was +41°С.

The comparison of the parameters provided in the table and the data presented in Section
4.1 shows that absolute temperatures observed at all operating NPPs are not exceeded.
For WWER-1000 units
To analyze the impact of extreme temperatures on operation of NPP systems, all systems
are divided into two categories depending on the cooling method:− systems that use different types of water-cooled heat exchangers. Water with atemperature from +5 to +33 ºС shall be supplied to these systems to ensure theirnormal operation;− ventilation systems that use atmospheric air for cooling. The indoor temperatureshall promote absorption of excessive heat and the equipment temperature shallbe kept in compliance with technical specifications for normal operation of such
systems.
Different ventilation systems are used for cooling of supporting safety systems. As a rule,these systems use water from the essential service water system as a coolant. Thesesystems include air conditioning and recirculation ventilation. The required air temperature inventilation and air conditioning systems is maintained within operational limits by auxiliary
equipment (heat exchangers, cooling equipment, etc.) and the air is supplied from rooms
which are not directly connected with the atmosphere.
The operability of auxiliary ventilation systems is determined by the capability of spray
ponds to maintain temperature of the cooling water in the range +5÷+33ºС. The system
performance criterion is supply of cooling water through the emergency and regularcooldown heat exchanger at a flow rate of 3000 m3/h for the respective safety system train.

60

STATE NUCLEAR REGULATORY INSPECTORATE OF UKRAINENATIONAL REPORT ON STRESS TEST RESULTS

Service water is cooled in spray ponds during hot summer months by spraying it throughnozzles. During the cold period when temperature is below 15ºC, idle water discharge
without spraying is provided.
The capacity of spray ponds was selected to ensure performance without supply of makeup water during the specified time (24 hours) required for repair and recovery of any makeup water system of the ponds. The volume of water in one pond is 21250 m3. Water frommake-up stations of spray ponds is supplied to compensate for evaporation and windinduced losses of spray water ponds.
It should be considered that water is renewed every 7 hours in the pond during the cold
period, and its temperature is mainly determined by the temperature of water supplied fromthe reactor compartment cooling system. Taking into consideration that the temperature ofwater supplied from the reactor compartment cooling system is maintained in the range 1245ºС, it can be stated that extremely low air temperature will not decrease water temperaturein the spray pond below the design value (5ºС). Hence, low temperatures do not pose
hazards for cooling systems that use water from spray ponds. Control of water temperatureand the redundant make-up system allow maintaining water temperature in spray ponds
within design limits as required.
For WWER-440 units
The analysis demonstrated that heat removal to the ultimate heat sink was characterized
by the following conditions:− when one heat removal channel is in use, the required temperature (33°С) for
ECCS heat exchangers is maintained at the mean daily temperature for the fivehottest days per year, with 10% probability, at Tair=25. 6°С, 70% humidity, 2.7
m/sec wind speed, and flow rate of circulating water in the channel of 3888 m³/h
at thermal load (26. 4 + 24. 2) =50.6 Gcal/h).
− when two heat removal channels are in use (which meets the single-failure
criterion), the required temperature of 33°С for ECCS heat exchangers ismaintained at Tair= 30.0°С (minimum threshold of exceeding the maximum
temperature per year with k=0.964, 65% humidity, 2.7 m/sec wind speed, flowrate of circulating water in two channels of 7776 m³/h at thermal load (26.4 +24.2)=50.6 Gcal/h).
In determining a threshold value for extreme temperatures, it was established that theessential service water system is capable of ensuring the required temperature of coolingwater at air temperature of 36.4°С in operation at rated power. The highest temperature
above 25°С can last no more than 6-7 hours per day and above 30°С no more than 1.5-2hours.
Extremely low temperatures do not affect cooling safety systems due to the following
reasons:− safety system piping is laid at a depth of more than 5 m, which is much lower
than frost penetration;− a heat conservation mode is envisaged for spray ponds to prevent water
overcooling in winter. For this purpose, a greater amount of warm water fromheat exchangers of safety systems is supplied under the spray pond. A smaller
amount of warm water is sprayed through nozzles to prevent their freezing andkeep them operable to accept full thermal loading from the emergency cooldown
heat exchanger;− a combined cooling system is envisaged for emergency heat removal: part of thespray pond operates without spraying and the other part (36 nozzles) withspraying.

61

STATE NUCLEAR REGULATORY INSPECTORATE OF UKRAINENATIONAL REPORT ON STRESS TEST RESULTS

Heavy Precipitations
Rain water drains and industrial and storm water sewage systems are envisaged toprotect buildings and facilities at the Zaporizhzhya, Khmelnitsky, Rivne and South Ukraine
NPP sites from precipitations. Surface water is drained from the sites and 750 kV open
switchyards via bladed surfaces to road gutters or trenches, as well as via storm-watercollectors around sites with subsequent discharge to storm sewage. Excessive rain water isabsorbed into the soil.
Zaporizhzhya NPP
Water accumulation at the Zaporizhzhya NPP site in case of heavy rains can bepotentially hazardous if its level is higher than certain site structures and thus may lead to an
emergency situation. Rain water drains and industrial and storm sewage systems aredesigned to protect buildings and facilities at the Zaporizhzhya NPP site against
precipitations. The designed capacity of the industrial and storm sewage system is sufficient
to drain rainwater from the on-site road surfaces with precipitation intensity up to 90
L/sec×ha.
The maximum observed precipitation levels at the Zaporizhzhya NPP site are lower thanthe design criteria established for Zaporizhzhya site engineering structures. Site walkdowns
and analysis of site structures did not reveal any components whose flooding can cause asite emergency in case of heavy rains.
Entrances into site buildings and structures are sufficiently elevated above the groundlevel. Additionally, the Zaporizhzhya site surface is sloped down to the Kakhovka reservoir
shoreline.
Khmelnitsky NPP
Water accumulation at the Khmelnitsky NPP site in case of heavy rains can be potentiallyhazardous if its level is higher than certain site structures and thus may lead to an
emergency situation. Rain water drains and industrial and storm sewage systems aredesigned to protect buildings and facilities at the Khmelnitsky NPP site from precipitations.
The designed capacity of the industrial and storm sewage system is sufficient to drainrainwater from the on-site road surfaces with the precipitation intensity up to 100 L/sec×ha.
The maximum observed precipitation levels at the Khmelnitsky NPP site are lower thanthe design criteria established for site engineering structures. Site walkdowns and analysis of
on-site structures did not reveal any components whose flooding can cause a site
emergency in case of heavy rains.
The zero level of all Khmelnitsky NPP site buildings is located at least 150 mm above theactual ground level close to the building. The site is leveled in a way that the slopes areoriented from the buildings to prevent flooding of the main facilities and buildings. Land androads around the reactor buildings are sloped down to the intake channel to drain rainwater if
the storm sewage is failed.
Rivne NPP
Water accumulation at the Rivne NPP site due to heavy rains can be potentiallyhazardous if its level is higher than certain site structures and thus may lead to an
emergency situation. Rain water drains and industrial and storm sewage systems aredesigned to protect buildings and facilities at the Rivne NPP site against precipitations. The
designed capacity of the industrial and storm sewage system is sufficient to discharge
rainwater from the on-site road surfaces with the precipitation intensity up to 100 L/sec×ha.
The maximum observed precipitation levels at the Rivne NPP site are lower than thedesign criteria established for site engineering structures. Site walkdowns and analysis of
structures did not reveal any components whose flooding can cause a site emergency incase of heavy rains.
62

STATE NUCLEAR REGULATORY INSPECTORATE OF UKRAINENATIONAL REPORT ON STRESS TEST RESULTS

The zero level of all RNPP site buildings is located at least 150 mm above the real groundlevel close to the building. The site is sloped from North to South-West down to the Styr river.
Thus all accumulated water will run down to lower areas.
South Ukraine NPP
Water accumulation at the South Ukraine NPP site due to heavy rains can be potentiallyhazardous if its level is higher than certain site structures and thus may lead to an
emergency situation. Rain water drains and industrial and storm sewage systems aredesigned to protect buildings and facilities at the South Ukraine NPP site against
precipitations. The designed capacity of the industrial and storm sewage system is sufficient
to drain rainwater from the on-site road surfaces with the precipitation intensity up to 90
L/sec×ha.
The maximum observed precipitation levels at the South Ukraine NPP site are lower thanthe design criteria established for site engineering structures. Site walkdowns and analysis of
structures did not reveal any components whose flooding can cause a site emergency incase of heavy rains.
Entrances into site buildings are sufficiently elevated above the ground level. Surface
water is drained via the bladed surfaces to road gutters or trenches, as well as via stormwater collectors around the site with subsequent discharge to storm sewage. Excessive rainwater is absorbed into the soil.
Tornados
In the framework of stress tests, safety margins of buildings and structures have beenassessed for all three factors of tornado impact, mentioned in Section 4.1.
Frontal Wind Pressure. The wind frontal pressure for all NPP sites calculated using
statistics data is in the range from 6.0 to 12.0 kPa. Category I buildings and structures for all
operating units are designed to withstand an air shock wave with frontal pressurecompression pressure ∆Р = 30 kPa. Therefore, all category I buildings and structures havesafety margins in terms of tornado frontal wind pressure.
Pressure Drop. To assess safety margins of buildings and structures in terms of pressure
drop caused by tornado, calculation load (according to statistics data) is compared with amore conservative value from SAR.
Tornado impact on buildings and structures resulting from pressure drop (drop of
atmospheric pressure) has the following features: in case of completely open structures,
including skeleton-type buildings with openings, cooling towers, ventilations stacks, etc.,
internal and external pressure become equal almost immediately and additional loads on
structures induced by pressure drop are negligibly small. In closed buildings and structures,pressure does not change in case of tornado, and internal explosion effect may occur.
Closed buildings and structures (without openings) include reactor containment and buildingof emergency diesel generators. Assessed safety margins for closed buildings and structuresin terms of pressure drop between the tornado center and periphery are provided in Table. It
is shown that there are safety margins for this impact.
Safety Margins for Pressure Drop in Tornado
Site

ZNPP

KhNPP

RNPP

SUNPP

Load
Calculation value(according to statistics) (kPa)

10.3

7.0

7.0

6.4

10.9

10.0

10.0

8.1

Conservative value (acceptedin SAR) (kPa)63

STATE NUCLEAR REGULATORY INSPECTORATE OF UKRAINENATIONAL REPORT ON STRESS TEST RESULTS

Flying Missiles. Analysis shows that tornadoes of classes 0 – 3 cannot cause flying
missiles hazardous for NPP buildings and structures.
Hence, it can be stated that there is no significant negative effect from a tornado onbuildings and structures and safety systems and safety-related systems located in them.
There is potential for some damage to window and door openings of skeleton-type buildings
and structures, which will not lead to degradation of safety functions.
In terms of heat removal to the ultimate heat sink, there is a potential risk of failure of open
components of the essential service water system due to loss of water in case of tornado.
This event is analyzed in SAR. The stress tests confirmed the need for compensatory
measures to ensure heat removal to the ultimate heat sink in case of loss of water in spray
ponds following a tornado.
Analysis of tornado impact on the dry spent fuel storage facility at the Zaporizhzhya NPP
site also revealed no negative impact. Robustness against tornadoes is ensured by thedesign and structural materials of the storage facility. The ventilated storage cask (VSC) isthe first barrier for protection against tornado. The strength calculations performed in SAR
demonstrate that the design features of the storage facility ensure complete VSC robustness
against tornado impact. The most vulnerable place in terms of tornado can be clogging of air
vents of VSC. Partial and complete clogging of air vents, which is a realistic situation, hasbeen analyzed in detail in the SAR for the dry spent fuel storage facility. The results showthat safety is not affected in this case.
External Fires
The 10-km areas of the operating NPPs are free from fire hazardous sources like oil andgas mains, delivery ducts, underground and surface storage tanks with flammable
substances for more than 1000 m³, as well as airports, air communication and flight lines(limited to 5 km in radius from NPP and 6 km in height), coal and peat mining facilities.
Forests adjacent to NPPs are considered the main potential external fire source for thesites.
The actual distance from Zaporizhzhya NPP units to the forest is not less than 400 m,
which exceeds the design safety limit of 100 m from a leeward side.
The actual distance from Khmelnitsky NPP units to the forest is not less than 550 m,
which exceeds the design safety limit.
The actual distance from Rivne NPP units to the forest is not less than 500 m, which
exceeds the design safety limit.
There are no woodlands around the South Ukraine NPP site.
4.2.2 Measures Which Can Be Envisaged to Increase Robustness of the Unitsagainst Extreme Weather Conditions
Tornado strike on the Zaporizhzhya, Khmelnitsky, Rivne and South Ukraine NPP sites canpotentially result in a failure of spray ponds of the essential service water systems (ESWS)
due to its impact on the open water surface (water ejection; water funnels resulting in air
plugs inside suction lines; drift of trash resulting in clogging of suction line baskets). Loss of
ESWS can cause failure of emergency power supply from emergency diesel generators(EDG).
The following cooling water supply procedures were developed at the Zaporizhzhya NPP
to compensate for ESWS pump failure:− procedure for cooling water supply to EDGs from fire water posts;− procedure for cooling water supply to safety system pumps from fire water posts;− procedure for cooling water supply to EDG compressors US11(21,31)D01 fromfire water posts (additional insets into ESWS are required).
64

STATE NUCLEAR REGULATORY INSPECTORATE OF UKRAINENATIONAL REPORT ON STRESS TEST RESULTS

A concept for water supply to fire piping from a suction dredge ship was developed. In thiscase, the fire pipeline will be used to supply cooling water to safety system equipment andalso for spray pond makeup.
Measures on tornado resistance enhancement for the Khmelnitsky, Rivne and South
Ukraine NPPs shall be developed and implemented.
No additional measures are required to enhance the resistance of the Zaporizhzhya,
Khmelnitsky, Rivne and South Ukraine NPPs to extreme winds, precipitations, temperatures,
external fires and their combinations.

65

STATE NUCLEAR REGULATORY INSPECTORATE OF UKRAINENATIONAL REPORT ON STRESS TEST RESULTS

5. LOSS OF ELECTRICAL POWER AND LOSS OF ULTIMATE HEAT SINK
5.1

Loss of Electrical Power

5.1.1

Loss of Off-site Power

Loss of off-site power to WWER-440/1000 leads to loss of on-site power that causes
disconnection of the main plant equipment. To ensure power supply to systems that are
required to maintain the units in a safe state, WWER-1000 and WWER-440 reactors areprovided with essential power supply systems (EPSS).
EPSS is designed using the same principles as safety systems: redundancy, physicalseparation, and independence of system trains. It has three independent trains with theidentical components sets.
In case of loss of off-site power, power is supplied from emergency diesel generators andbatteries. In terms of power and configuration of connected loads, each train of theemergency power supply system is capable of ensuring safe shutdown state in all designbasis accidents. In case of loss of off-site power, signals for startup of the diesel generators
are actuated independently for each DG. Therefore, the high reliability of emergency power
supply function is provided.
Each unit of Ukrainian NPPs has three DGs. In addition, all NPPs are provided with
common-unit DGs (for detailed information see below):− Zaporizhzhya NPP – 20 DGs. There are three DGs per unit and two additionalcommon-unit DGs for units 5 and 6.
− Rivne NPP – 14 DGs. There are three DGs per unit and two additional commonunit DGs for unit 4.
− South Ukraine NPP – 11 DGs. There are three DGs per unit and two additionalcommon-unit DGs for unit 3.
− Khmelnitsky NPP – 8 DGs. There are three DGs per unit and two additionalcommon-unit DGs for unit 2.
The power of each common-unit DG (5600 kW) was selected to ensure power supply to
all main equipment of two units, taking into account failure of one of the DGs.
All DGs are actuated automatically. When necessary, the DGs could be started by the
MCR operator. Time delay to full power operation is less than 15 seconds. Loads areconnected to DGs by the sequential loading program.
All DGs at NPPs are provided with 7-day reserve of diesel fuel, and DG design-basis nonserviceable operation in emergencies is 250 hours. Consequently, it may be concluded thatthe emergency power supply system was designed using the redundancy principle, has asufficient number of DGs (3 DGs per unit as a minimum), and the design features permit highreliability of the system.
It should be pointed out that a series of measures to increase reliability of power supply tosafety systems are ongoing under the Comprehensive (Integrated) Safety Improvement
Program (C(I)SIP). For instance, modifications to allow supply of power to safety systems ofan affected unit from the neighboring units of the same NPP have been implemented.
In case of loss of off-site power, the reactor protection system actuates signals (by MCP
trip, or frequency decrease, by turbine-driven feedwater pumps trip) and the reactor istransferred into subcritical state by insertion of control rods. Heat is removed from the reactor
via the secondary circuit through makeup of steam generators using emergency feedwater
systems and steam dump devices (BRU-A, SG SV). Natural circulation is established in the
primary circuit, the reactor is in stable state with high coolant pressure and temperature.
Under normal operation of systems and interlocks, loss of off-site power does not lead tofurther increase of primary parameters and necessity of dumping primary coolant via thepressurizer pilot-operated relief valve (PRZ PORV).
66

STATE NUCLEAR REGULATORY INSPECTORATE OF UKRAINENATIONAL REPORT ON STRESS TEST RESULTS

Hence, in case of loss of off-site power, the WWER-1000 and WWER-440 reactors can betransferred into a safe state and ensure continuous decay heat removal for more than 72
hours.
5.1.2

Loss of Off-site Power and Loss of the Ordinary Backup AC Power Source

In case of an accident caused by loss of off-site power and failure of all DGs, decay heatremoval function is not performed. Without operator actions, this will lead to loss of the
primary coolant and uncovering and damage of fuel. However, the operator can restore
power supply from one of the off-site sources.
There are additional sources and options for supply of power to 6 kV buses ofZaporizhzhya in-house systems:− power supply from the Zaporizhzhya Thermal Power Plant if it remains
operational;− power supply from Dnipro Hydroelectric Plant through two independent supply
lines;− power supply from the Kakhovka Hydroelectric Plant;− power supply from one (any) DG of any other Zaporizhzhya NPP unit that is
automatically transferred to the in-house power supply mode;− power supply from common-unit DGs;
− power supply to Zaporizhzhya NPP 750 kV outdoor switchyards from the
Yuzhnodonbass 750 kV high-voltage line (if the Donbass electrical grid is
successfully separated from the Ukrainian unified electrical grid) or from one of
the high-voltage lines (Dnipro or Zaporizhzhya).
Corresponding procedures for power supply restoration were developed and emergency
operating procedures (EOP) were updated for ZNPP units 1-6 (2010). Plant staff has passed
corresponding training and their skills are maintained by scheduled trainings.
There are additional sources and options for supply of power to 6 kV buses ofKhmelnitsky in-house systems:− power supply to internal grid from the one (any) DG of any Khmelnitsky NPP unitthat automatically transferred to the in-house power supply mode;− power supply to internal grid from any common-unit DGs.
Plant staff is also recommended to try to power safety systems from alternative sources
such as the power unit remaining operational or from the grid through 330/750 kV outdoor
switchyard via the 330 kV high-voltage line (Shepetovka, Rivne or Khmelnitsky substation) or
via 750 kV high-voltage line.
The Rivne NPP has the following additional sources and options for power supply to 6 kV
buses of plant in-house systems:− power supply to plant internal grid from one (any) DG of unit 1 or 2 as well asfrom one (any) DG of unit 3 or 4, which automatically transferred to the in-house
power supply mode;− power supply to plant internal grid from any common-unit DG.
The operator is recommended to try to power safety systems from alternative sources:from the units that remain operational or from the grid through outdoor switchgear buses via
one of four 330 kV high-voltage lines (Rovno, Grabov, Kovel or Lutsk Sev substations) or via
750 kV high-voltage line (Zapadnoukrainskaya substation).
The South Ukraine NPP has the following additional sources and options for power supply
to 6 kV buses of plant in-house systems:− Kremenchug Hydroelectric Plant, which uses a renewable energy source anddoes not require special conditions for electricity generation;− Tashlyk Hydroelectric Pumped Storage Plant, which is operated in generator
mode. The startup of the Tashlyk plant in the generator mode is possible only if
its internal grid is powered from the Alexandrovka Hydroelectric Plant;
67

STATE NUCLEAR REGULATORY INSPECTORATE OF UKRAINENATIONAL REPORT ON STRESS TEST RESULTS− DGs of unit 2 connected via the transmission lines may be a source of power for
one of the safety systems of the unit 1. It is necessary to monitor the DG power
and load to prevent DG overloading;− SUNPP Unit 3, which automatically is transferred to power supply mode to NPP
internal grid. The long-term operation of Unit 3 in power supply mode to internal
grid ensures:
 in-house systems of units 1, 2;
 Tashlyk Pumped Storage Plant operating in the engine mode; loadings in the region adjacent to the South Ukraine NPP.
In case of an accident, the design requirements related to duration of battery operation for
all the NPP units in full load is 1 hour. It should be noted that the actual time of operationfrom batteries will exceed the design-basis one. In addition, lists of loads to be disconnected
to extend the battery operation time have been developed for all Ukrainian NPPs.
According to analysis of beyond design basis accidents involving long-term station
blackout and failure of all DGs, it is required to restore power to one pump of the lowpressure injection system or one SG emergency feedwater pump to prevent core damage. In
this regard, a safety upgrade has been implemented at Rivne NPP units 1 and 2 (WWER440). A steam generator additional emergency feedwater system (AEFS) has been
introduced at these units. This system is independent and survivable because its
performance does not depend on other safety systems and normal operation systems. AEFS
pumps are driven directly by their own air-cooled diesel engines. The water inventory of
AEFS is 2х1000 m3. In case of station blackout, the AEFS inventory is sufficient to ensure
long-term decay heat removal. The AEFS tanks can be refilled (detailed information on the
AEFS is presented in Section 1.1.2 R).
Taking into account the above-mentioned information, it can be concluded that under lossof off-site power and loss of all DGs for WWER-1000 and WWER-440 type reactors theadequate operator actions aimed at transferring the reactor unit to safe state are envisaged.
5.1.3 Loss of Off-site Power and Loss of the Ordinary Backup AC Power
Sources, and Loss of Permanently Installed Diverse Backup AC Power Sources
In case of loss of off-site power, loss of the ordinary backup AC power sources and loss ofpermanently installed diverse backup AC power sources (station blackout), the power fromthe batteries remains available.
Current Ukrainian EOPs for WWER-1000 NPPs include procedures developed to increasetime before core damage. These procedures include operator actions on SG makeup fromturbine hall deaerators and primary system makeup from ECCS hydroaccumulators.
Implementation of such activities allows significantly extending time before the core damage(more than for 12 hours). However, these actions after discharge of the batteries require
mobile energy sources to monitor necessary parameters and control the respective valves.
Therefore, EOPs recommend alternative actions based on connection of a mobile diesel
generator and pumping unit (MDGPU). General requirements for MDGPUs, including theirconfiguration and location on the site, have been developed in the framework of stress tests.
At WWER-440 units the same functions can be performed by AEFS.
Regarding SFP, the time available to fuel heatup above the design limits for WWER1000/V-320 is 7.5 hours, for WWER-1000/V-302, V-338 is 6.5 hours, and for WWER-440/V213 is 16 hours. These values were calculated in the framework of stress tests.
5.1.4 Conclusion on the Adequacy of Protection against Loss of ElectricalPower
Based on analysis of emergencies caused by loss of off-site power including total station
blackout for Ukrainian WWER-1000 and WWER-440 units, the following can be concluded:− in case of loss of off-site power, WWER-1000 and WWER-440 can be transferred
into the safe state and decay heat removal can be provided within more than 72
hours in case of site isolation;
68

STATE NUCLEAR REGULATORY INSPECTORATE OF UKRAINENATIONAL REPORT ON STRESS TEST RESULTS− in case of loss of off-site power and failure of all DGs, there are additional
possibilities and adequate operator actions intended to transfer the reactor into
the safe state (Section 5.1.2);− in case of loss of off-site power and loss of the ordinary backup ac powersources, and loss of permanently installed diverse backup ac power sources, themain specific features of accident progression are: loss of monitoring of the main reactor parameters due to discharged
batteries that complicates transfer NPP units into the safe state andmaintaining it; potential deficiencies of SG and/or primary circuit makeup andcooldown, as well as SFP makeup and cooling for long time (up to 3 days) incase of NPP isolation.
In this case, EOPs recommend using mobile devices for SG emergency makeup and SFP
makeup and cooling.
The AEFS is capable of ensuring long-term heat removal from the core in case of total
station blackout at Rivne NPP unit 1 and 2 with WWER-440 reactors.
5.1.5 Measures Which Can Be Envisaged to Increase Robustness of the Plants
in Case of Loss of Electrical Power
Measures on possible accident management in case of total station blackout to provide
emergency power supply and primary and secondary makeup within a long-term period weredeveloped in the framework of stress tests. Corresponding calculations were performed todetermine necessary water inventory and equipment configuration, and proposals on
equipment layout were developed. A detailed description of the proposed measures ispresented in Section 5.3.3.
5.2

Loss of the Decay Heat Removal Capability/Ultimate Heat Sink

5.2.1 Design Provisions to Prevent the Loss of the Primary Ultimate Heat Sink,
Such as Alternative Inlets for Sea Water or Systems to Protect Main Water Inlet
from Blocking
Emergency cooling at WWER-1000 and WWER-440 units as well as heat removal toultimate heat sink are provided by the following systems:− emergency core cooling system (ECCS) with subsequent heat removal to theultimate heat sink via the essential service water system;− secondary circuit with subsequent heat removal to the ultimate heat sink via thesecondary steam dump devices.
Design features related to prevention of loss of heat removal are presented in Sections
1.1.2 Z, 1.1.2 Kh, 1.1.2 R and 1.1.2 SU.
5.2.2 Loss of the Primary Ultimate Heat Sink (e.g., Loss of Access to Cooling
Water from the River, Lake or Sea, or Loss of the Main Cooling Tower)
Loss of access to cooling water from the river or pond results in failure of the coolingwater system. In such emergency conditions, operator actions are intended to decreaseprimary pressure, provide alternative heat removal from safety systems (using emergency
service water tanks, alternative water sources), transfer the reactor into a safe shutdown
state and perform recovery actions.
The reactor cooling is performed through secondary system by means of SG emergency
feedwater supply and steam discharge via BRU-A or SG SV by operator.
The strategy of SG makeup from deaerators and opening of PRZ PORV to decreaseprimary pressure to allow discharge of hydroaccumulators can be considered as analternative. This strategy for WWER-1000 reactors will allow decrease in primary pressureand ensure operation of the LPIS. Thereafter, alternative heat removal to the ultimate heatsink must be provided by one LPIS train or one SG emergency feedwater train. For WWER69

STATE NUCLEAR REGULATORY INSPECTORATE OF UKRAINENATIONAL REPORT ON STRESS TEST RESULTS

440 reactors, this strategy can be implemented even without possibility of SG makeup fromdeaerators (taking into account AEFS operation).
Therefore, in case of loss of access to cooling water from the river or pond or loss of themain cooling tower, adequate operator actions intended to decrease primary pressure,transfer the reactor to a safe shutdown state are envisaged. Consequently, Ukrainian NPPs
with WWER-1000 and WWER-440 reactors are capable of ensuring long-term decay heatremoval during more than 72 hours in case of site isolation.
5.2.3

Loss of the Primary Ultimate Heat Sink and the Alternate Heat Sink

Progression of this accident is similar to progression of the total station blackout. The
main difference is later failure of active systems since pumps will remain operational forsome time without cooling and, thus, a longer time margin before core damage will beensured. In this case, the operator has more time available for emergency actions.
Secondary steam dump devices and PRZ PORVs will remain in operation.
EOPs (for WWER-1000 units) govern operator actions that are aimed at decreasing
primary pressure to allow LPIS operation and are based on the use of SG makeup from TG
deaerators and discharge of hydroaccumulators (if there is no possibility to use primaryemergency makeup and cooldown system). This will allow significant increase in time toreactor core damage.
AEFS has been implemented at Rivne NPP units 1 and 2 with WWER-440 reactors.
AEFS pumps are driven directly by their own air-cooled diesel engines. The water inventoryof AEFS is 2х1000 m3. Taking into account the possibility to refill system tanks, AEFS pumps
can ensure long-term heat removal from the core in case of total loss of primary heatremoval (detailed information on the AEFS is presented in Section 1.1.2 R).
In the framework of stress tests, the calculation analysis for the most unfavorable accident
conditions, i.e. combination of station blackout and loss of decay heat removal to the ultimate
heat sink has been performed, and time available to reactor core damage as well as cliffedge effects have been identified (the results are provided in Section 5.3).
5.2.4
Sink

Conclusion on the Adequacy of Protection against Loss of Ultimate Heat

The following conclusions can be made upon results of accident analysis related to loss ofultimate heat sink:− in case of loss of primary heat removal (emergency trip of cooling tower fans andpumps, drop of pressure in the discharge line etc.) and NPP isolation, adequate
operator actions are envisaged. They are aimed at decreasing primary pressure,use of alternative heat removal sources and reactor transfer into a safe state;− in case of loss of primary heat sink and impossibility to use an alternative heatsink, the main features of accident progression are as follows: possible deficiency of SG and/or primary circuit makeup and cooldown
as well as SFP makeup and cooling for long time (up to 3 days) in case of
NPP isolation;
 inability to provide normal heat removal through the secondary and/or
primary circuit for a long-term period (more than 72 hours) under loss ofultimate heat sink; inability to provide normal heat removal from SFP for a long-term period(more than 72 hours).
In this case, EOPs recommend applying procedures based on connection of alternative
power supply sources and MDGPU aimed at providing SG emergency makeup, as well as
SFP makeup and cooling.

70

STATE NUCLEAR REGULATORY INSPECTORATE OF UKRAINENATIONAL REPORT ON STRESS TEST RESULTS

5.2.5 Measures Which Can Be Envisaged to Increase Robustness of the Plants
in Case of Loss of Ultimate Heat Sink
Measures on possible accident management in case of loss of ultimate heat sink toprovide primary and secondary makeup within a long-term period were developed in theframework of stress tests. Corresponding calculations were performed to determine
necessary water inventory and equipment configuration, and proposals on equipment layout
were developed. A detailed description of the proposed measures is presented in
Section 5.3.3.
5.3 Loss of the Primary Ultimate Heat Sink, Combined with Station Blackout
Safety systems and power supply from unit-specific DGs, common-unit emergency DG
and other on-site AC sources are not considered for initiating event (IE) “loss of primary heatsink combined with station blackout”. Battery-powered equipment is the only equipment thatremains in operation.
Natural circulation of primary coolant is established upon the MCP coastdown. Whensecondary pressure exceeds specific setpoints, BRU-As are opened and remain in thisposition after battery discharge (estimated discharge time of batteries is 1 hour). The rise in
primary coolant temperature results in increase of pressure due to thermal expansion of thecoolant. Periodical spring-driven actuation of the PRZ RV leads to decrease in the primarycoolant inventory. Decrease of the coolant level in the reactor core and loss of fuel heatremoval capability leads to fuel overheating with further potential melting. Prevention ofsevere fuel damage in the reactor core requires restoration of the reactor coolant level andheat removal from fuel rods. Results from evaluation of time available for operator actions
and emergency strategy efficiency are provided below.
5.3.1. Time of Autonomy of the Site before Loss of Normal Cooling Condition of
the Reactor Core and Spent Fuel Pool (e.g., Start of Water Loss from the Primary
Circuit)
Numerical analyses of the IE “total station blackout and loss of heat removal to ultimate
heat sink” have been carried out for all types of Ukrainian NPPs in the framework of stresstests. This accident was selected because, in terms of degradation of heat removal
conditions, a combination of station blackout and loss of heat removal to the ultimate heatsink is the most conservative and limiting case. The calculation analyses were performed
based on conservative assumptions. The analysis was intended to:− identify the minimum time span available until the maximum design limit of fuelrod damage is exceeded;− identify cliff-edge effects;− analyze efficiency of operator actions according to EOPs;− identify the minimum SG makeup flow rate and the required water inventory to
prevent severe core damage during 3 days;− identify the minimum primary makeup flow rate and water inventory necessary to
prevent severe core damage during 3 days.
The analyses were carried out for:
Reactor operation at rated power:− basic scenario “total station blackout and loss of heat removal to the ultimate heatsink” (taking into account operation of first category non-interruptible power
supply equipment and capacity of batteries, operator actions according to EOPs);− total station blackout and loss of heat removal to the ultimate heat sink withsecondary “feed and bleed” procedure using a low-head MDGPU;− total station blackout and loss of heat removal to the ultimate heat sink withprimary “feed and bleed” procedure using MDGPU;− total station blackout and loss of heat removal to the ultimate heat sink withpressurizer safety relief valve stuck open (medium LOCA);
71

STATE NUCLEAR REGULATORY INSPECTORATE OF UKRAINENATIONAL REPORT ON STRESS TEST RESULTS− total station blackout and loss of heat removal to the ultimate heat sink withpressurizer safety relief valve stuck open and primary “feed and bleed” procedureusing MDGPU (pressurizer SRV stuck open was assumed conservatively tocover the possible primary leaks, including leaks through MCP seals).
To determine the minimum time available to reactor core damage, additional analysis of
total station blackout and loss of heat removal to the ultimate heat sink without operator
actions according to EOPs has been carried out.
Reactor in shutdown states:− total station blackout and loss of heat removal to the ultimate heat sink, reactor isopen;− total station blackout and loss of heat removal to the ultimate heat sink, taking
into account measures aimed at preventing reactor core damage.
Spent fuel pool:− station blackout and loss of decay heat removal from SFP to the ultimate heatsink;
− station blackout and loss of decay heat removal from SFP to the ultimate heatsink, taking into account measures aimed at preventing fuel damage.
The calculation analyses have been performed using validated and verified models for the
RELAP/Mod 3.2 computer code developed previously in the framework of safety analysis
report.
The time margin to core melting in case of station blackout and loss of heat removal to theultimate heat sink is determined by the ratio of decay heat power to primary and secondarywater inventory. In the first stage of the accident, heat is removed from the primary circuit
through evaporation of SG water and stable natural circulation in the primary circuit. Operator
actions according to EOPs, aimed at SG makeup using pressure drop between SG anddeaerator induced by elevation difference, provide additional time and substantially extend
the duration of the first stage.
The second stage of the accident starts after exhaustion of SGs and deaerators andtermination of primary-to-secondary heat transfer due to decrease of the SG water level
below the tube bundle. Power generated in the reactor core is removed through evaporationand discharge of the primary coolant through pressurizer safety relief valves. The analysis oftime available to core melting is presented below for WWER-1000/V-320 (Zaporizhzhya-5).
Decay heat
power
%/MW

1/30.0Stage 1
SG waterTime, hinventory /deaeratorwater
inventory, t
120/
8.3
334

Flow
rate,
t/h

Decay heat
power
%/MW

54.5

0.75/
22.5

Stage 2
PrimaryTime,coolanthinventory/tank water
inventory, t
238/
10.3
167

Flow
rate,
t/h

34.5

This table demonstrates the following: if it is not possible to restore operation of thesafety/safety related systems for a long-term period, the emergency strategies are limited tousing independent mobile sources for:− makeup of the secondary circuit during the first stage (with minimum flow rate
54.5t/h)− makeup of the primary circuit with boric acid solution during the second stage(with minimum flow rate 34.5t/h).
More detailed analysis of emergency strategies data is provided in Section 5.3.3.

72

STATE NUCLEAR REGULATORY INSPECTORATE OF UKRAINENATIONAL REPORT ON STRESS TEST RESULTS

Primary Coolant and SG Mass Inventory in Case of Total Station Blackout and Loss of Heat
Removal to Ultimate Heat Sink

Decay Heat Power and Power Transferred from Primary to Secondary Circuit in Case of
Total Station Blackout and Loss of Heat Removal to Ultimate Heat Sink
Based on the calculation analyses, the time margin to severe core damage wasdetermined as follows:− for WWER-1000/V-320 – more than 18 hours;− for WWER-1000/V-302, WWER-1000/V-338 – 12 hours;− for Rivne NPP units 1 and 2 (WWER-440/V-213) – about 10 hours.
It should be noted that the available time margin for WWER-440/V-213 was calculated
very conservatively, since operation of AEFS was not taken into account. Operation of AEFS
73

STATE NUCLEAR REGULATORY INSPECTORATE OF UKRAINENATIONAL REPORT ON STRESS TEST RESULTS

can provide long-term decay heat removal from the reactor core (more than two days withouttank refilling).
Results of the calculation analysis for station blackout and loss of the ultimate heat sink
for shutdown reactor states demonstrated that in case of the opened reactor, the operator
should start actions aimed at discharge of hydroaccumulators. In this case, the time available
to severe reactor core damage will be 8-10 hours. Further actions of the operator imply
alternative organizational and technical measures relating to the use of mobile water andpower supply sources.
The following cliff edge effects were identified upon the calculation analysis:
For WWER-1000/V-320 reactors:− 1 hour – conservatively estimated time for discharge of batteries (the operator
has no possibility to monitor reactor parameters and use PRZ PORVs andsecondary steam dump devices to reduce pressure);− 9 hours – time to decrease in the coolant level in the reactor below the hot legs
(secondary makeup becomes inefficient due to loss of natural circulation in thereactor coolant system (RCS) loops, end of the first stage);− 16.5 hours – the latest possibility for the operator to intervene (irreversible heatupof the reactor core starts and leads to severe core damage).
For WWER-440/V-213 reactors:− 1 hour – conservatively estimated time for discharge of batteries (the operator
has no possibility to monitor reactor parameters and use PRZ PORVs andsecondary steam dump devices to reduce pressure);− 7.5 hours (analysis with a conservative approach with no credit taken for operator
actions and operation of AEFS) – time to decrease in the coolant level in thereactor below the hot legs (secondary makeup becomes inefficient due to loss ofnatural circulation in the RCS loops, end of the first stage);− 9 hours (analysis with a conservative approach with no credit taken for operator
actions and operation of AEFS) – the latest possibility for the operator actions(irreversible heatup of the reactor core starts and leads to severe core damage).
For SFP of Ukrainian NPPs:− the time margin to fuel heatup above the design limits established for the mostunfavorable conditions, with the reactor core unloaded to SFP, constitutes about
6.5-7 hours.
5.3.2. External Actions Foreseen to Prevent Fuel Degradation
Calculation analyses of station blackout and loss of the ultimate heat sink with operator
actions for Ukrainian WWER-1000 demonstrated that core damage can be avoided in caseof makeup of one SG using a MDGPU having the flow rate of at least 13 kg/sec with pumphead of 7 kgf/cm2, which is sufficient for continuous decay heat removal. This strategy can be
implemented even at the late stage of accident management.
In case of total station blackout, SG makeup can be (heat removal by secondary circuit)performed using a ATs-40/4 fire truck having the following characteristics:− nominal flow rate at suction height of 3.5 m - 15 L/sec;− pump head – 0.9 MPa (9 kgf/cm2);− water inventory in the tank – at least 4500 L (or 5800 L);− load-bearing capacity – 7000 kg (or 10000 kg);− base unit chassis is 6×6 (or 6×4).
Similar makeup requirements are determined for SFP at the required flow of 6 kg/sec withpressure of 4 kgf/cm2.
The primary “feed and bleed” procedure and primary system makeup with boric acidsolution using another MDGPU having the flow rate more than 13 kg/sec at pressure of 20
kgf/cm2 can be a possible way of emergency makeup and cooling. Boric acid solution with74

STATE NUCLEAR REGULATORY INSPECTORATE OF UKRAINENATIONAL REPORT ON STRESS TEST RESULTS

the minimum concentration of 16g/kg must be injected into the primary circuit to prevent recriticality. This can be possible even for water with 0°С temperature taking into account thesolubility of boric acid.
Borated water can be injected into the primary circuit using inventory from the primarycoolant purification system.
To prevent severe core damage in WWER-1000 units, the required water inventory for
MDGPU for 3 days is 3370 t per unit; this inventory must be available on-site or delivered to
the MDGPU during an accident with required frequency.
The calculation analysis of the total station blackout and loss of ultimate heat sink with
operator actions for Rivne NPP-1, 2 (WWER-440) demonstrated that core damage can be
avoided in case of makeup of one SG using MDGPU with the flow rate of at least 4 kg/sec atpressure of 4 kgf/cm2. This flow rate is sufficient for continuous decay heat removal.
The primary “feed and bleed” procedure and supply of boric acid solution using another
MDGPU with the flow rate of at least 4 kg/sec with pump head of 25 kgf/cm2 can be apossible way of emergency makeup and cooling for WWER-440 primary circuit.
Similar requirements are determined for the SFP, the required flow rate is 3 kg/sec withpressure of 3 kgf/cm2.
To prevent severe core damage in WWER-440 units, the required water inventory for
MDGPU for 3 days is 1037 t per unit; this inventory must be available on-site or delivered to
the MDGPU during an accident with a required frequency.
At reactor cooldown using MDGPUs, it is very important to monitor temperature in the cold
legs and primary pressure to avoid reactor vessel cold overpressure.
The following parameters should be monitored in accident conditions with assumed power
supply from the MDGPU:− reactor power;− reactor period;− coolant temperature at fuel assembly outlet or under the reactor cover;− coolant temperature in hot legs;− coolant temperature in cold legs;− primary coolant pressure;− SG secondary pressure;− reactor coolant level;− pressurizer coolant level;− SG water level;− pressure in containment compartments;− hydrogen concentration in containment compartments;− radioactivity in steam lines.
There is an alternative possibility to monitor pressure and temperature using manometerreadings and infrared scanners.
The expediency of borated water storage for primary system makeup or its delivery andtreatment on the NPP site with a required frequency shall be analyzed additionally to selectthe best option.
5.3.3. Measures Which Can Be Envisaged to Increase Robustness of the Plants
in Case of Loss of Primary Ultimate Heat Sink, Combined with Station Blackout
Proposals on possible accident management in case of total station blackout and/or lossof the ultimate heat sink to provide primary and secondary makeup within a long-term period
have been developed in the framework of stress tests. Specific calculation analyses were
performed to determine necessary water inventory and equipment configuration, andproposals on equipment layout were developed. To ensure decay heat removal it isrecommended to implement the following measures:
75

STATE NUCLEAR REGULATORY INSPECTORATE OF UKRAINENATIONAL REPORT ON STRESS TEST RESULTS− increase capacity of batteries;− ensure SG emergency makeup: water injection into SGs from fire trucks located at the NPP site; restoration of power supply to stationary makeup pumps from a mobile
diesel generator;
 water injection into SGs from MDGPU;
 water injection into SGs from available stationary pumps of different
systems, which can potentially be used;− ensure emergency makeup of the primary circuit: borated water injection into the primary circuit from MDGPU;
 restoration of power supply to stationary makeup pumps from a mobile
diesel generator;− ensure SFP makeup and cooldown: restoration of power supply to regular SFP makeup and cooling pumps;
 water injection into the SFP from independent MDGPU or from the fire
extinguishing system; possibility of SFP passive heat removal.
Depending on the accident progression, the following facilities can be used to feed theprimary and secondary sides and spent fuel pool:− primary purification system and water treatment facility water storage tanks;− distillate, boron concentrate and borated water tanks;− water inventory in cooling towers of the service water supply system (V-302/338);− water of the fire extinguishing system;− spray ponds of group A (reactor hall) of the service water supply system;− artesian wells.
5.4 Loss of Electrical Power and Loss of Ultimate Heat Sink for Dry Spent Fuel
Storage Facility (DSF)
5.4.1

Loss of Electrical PowerThe DSF is a passive system. Electrically-driven mechanisms are used in the DSF system
only during loading of WWER ventilated storage casks at the Zaporizhzhya NPP. All otheroperations, including transportation of loaded WWER storage casks to the DSF site, as wellas their storage on the DSF site, do not require electricity supply.
Consequently, loss of off-site electrical power will not result in loss of heat removal on the
DSF site. In the framework of stress tests, special calculation analysis was carried out for theloss of off-site power supply during in-unit transportation and handling operations.
The blackout may lead to termination of handling operations at any time with spent fuelbeing inside the unit. Preliminary analysis revealed that the worst condition, in terms of heatexchange in multi-assembly sealed basket (MSB), is its location in an uncovered transfer
cask (i.e. filled with air). In that case, additional thermal resistance decreases heat exchange
rate at the boundaries of MSB. Under maintenance in normal conditions, the time of MSB
remaining in this position is restricted. However, in case of blackout, this time may extend up
to several days.
Conservative initial and boundary conditions have been selected for analysis. The
maximum residual power and minimum conductivity of cooling air in the model are selected
as initial conditions. The conservative heat transfer coefficient corresponding to conditions on
the outer surface of a concrete cask is assumed. The radiation heat transfer inside the fuelassemblies in the MSB and close to the MSB cover is not taken into account, which allows
increasing the energy stored in the MSB. The cooling agent is air under atmosphericpressure. Air temperature is assumed to be 40°С for normal conditions and 150°С for
accident conditions in the containment (maximum design limit). The flow of the cooling agent
is absent. The calculation was performed up to the moment of reaching the steady
temperature condition inside MSB.
76

STATE NUCLEAR REGULATORY INSPECTORATE OF UKRAINENATIONAL REPORT ON STRESS TEST RESULTS

The analysis confirmed that the steady temperature condition inside the basket is reachedin 2 days; it means that that maximum design limit of fuel assembly temperature is notreached.
Calculation results confirm safety of DSF in case of blackout.
5.4.2

Loss of Ultimate Heat Sink

Heat is removed from spent fuel assemblies through natural circulation of environmental
air via air ducts of WWER storage casks.
Loss of heat sink may occur if all inlet holes of air ducts are clogged. Since a ventilated
storage cask has four independent inlets of air ducts located on two opposite sites, clogging
of all inlets with debris, etc., is considered an unlikely case.
Despite this fact, in the framework of stress tests, hypothetical scenarios involving
clogging of all inlets of air ducts of WWER storage casks were analyzed with various initialassumptions.
The results of the calculations are summarized in the table below.

Fuel cladding, max

Storage basket

Inner concretesurface

Outer concretesurface

Air outlet

Conditions

Sun heating
consideration

Environment
temperature

Temperatures (sustained), °C

Allowable values

-

-

-

66

107

-

350

Normal storage conditions, steady
state

24

No

73

30

84

131

346

Extremely low temperature, steady
state

-40

No

-1

-35

7

69

297

Limiting values

-

-

-

93

177

-

450

Maximum thermal load oftransients

52

Yes

106

73

120

158

369

Extremely high temperature, steady
state

38

Yes

89

59

103

145

358

Half of inlets closed

24

No

78

31

88

133

348

All inlets closed

24

No

104

32

109

149

361

Basket in a transfer cask, helium

24

-

-

-

-

203

407

Based on the calculations for all selected extreme and emergency values ofenvironmental temperatures, the temperature of system components remains within therange permitted for fuel storage.
Calculation results confirm DSF safety in case of loss of the ultimate heat sink.
5.4.3

Combination of Blackout and Loss of Ultimate Heat Sink

A combination of blackout and loss of the ultimate heat sink due to design features andpassive principle of DSF performance represents no additional negative consequences ascompared with individual losses of safety functions discussed in Sections 5.4.1 and 5.4.2.
77

STATE NUCLEAR REGULATORY INSPECTORATE OF UKRAINENATIONAL REPORT ON STRESS TEST RESULTS

6. SEVERE ACCIDENT MANAGEMENT
6.1 Organization and Arrangements of the Licensee to Manage Accidents
6.1.1

Organization of the Licensee to Manage the Accident

Staffing and shift management in normal operation
The organizational structure of the Ukrainian nuclear operator (NNEGC Energoatom) andits separated entities – Rivne, Khmelnitsky, Zaporizhzhya and South Ukraine NPP(henceforth - NPPs) - is determined in accordance with the “Provisions on Organizational
Structure of NNEGC Energoatom”.
Shift operating personnel is headed by the Plant Shift Supervisor; his main task is toensure safe operation of NPP equipment and satisfy requirements for its safety. The Plant
Shift Supervisor is obliged to:− evaluate the nature and scope of any unforeseen deviations of NPP unit
parameters and operating modes including those which can lead to radioactivity
releases;− take initial measures to minimize consequences of radioactive releases;− ensure personnel safety and take measures to implement NPP emergency plans.
Operating personnel at each power unit is headed by the Unit Shift Supervisor; his
responsibilities include management of the MCR personnel and management of the NPP
power unit in accordance with the Technical Specifications and procedures.
Operating personnel of the NPP departments manage technological process inaccordance with the limits and conditions set by the operating procedures; they conduct
scheduled activities on maintaining reliability of the systems and components, perform
inspections, tests, outages for maintenance, monitor process parameters of the operating
equipment, detect deviations and malfunctions and respond to them in accordance with
operating procedures.
Personnel with necessary qualification and skills are available for all operational modes,
including normal operation, anticipated operational occurrences and accidents at nuclear
power plants.
Measures taken to enable optimum intervention by personnel
Optimum personnel intervention during accident management is achieved by thefollowing:− taking into account the human factor in the NPP design;− provision of operating and emergency procedures;− professional staffing with highly qualified personnel;− conducting emergency exercises.
Use of off-site technical support for accident management
Off-site technical support during accident management is ensured under the Emergency
Preparedness and Response System of the NNEGC Energoatom for accidents andemergencies at Ukrainian nuclear power plants. The Emergency Preparedness andResponse System includes a series of technical means and resources as well asorganizational, technical and health and safety measures implemented by the operatingorganization to prevent or decrease radiation impact on personnel, the public and theenvironment in case of a nuclear or radiation accident at the NPP.
The Emergency Preparedness and Response System is included into the National State
System for civil protection of the public and territories and has two interrelated levels: level ofthe NNEGC Energoatom management and NPP level. The procedures for actions in case ofan emergency are specified in the Emergency Response Plan of the NNEGC Energoatom
management and NPP Emergency Response Plans.
78

STATE NUCLEAR REGULATORY INSPECTORATE OF UKRAINENATIONAL REPORT ON STRESS TEST RESULTS

The Emergency Response Plan of the NNEGC Energoatom management envisages that
NNEGC Energoatom, if necessary, provides support to the NPP at which the accident has
occurred, including mobilization of means and resources of other nuclear power plants,
Emergency Technical Center (ETC) and AtomRemontService (ARS). The total number of theemergency organizational structures of the NNEGC Energoatom is:− KhNPP - 607 persons;− ZNPP - 1195 persons;− SUNPP - 790 persons;− RNPP - 729 persons;− ETC - 220 persons;− ARS -195 persons.
If necessary, nuclear power plants organize additional shifts for emergency groups andbrigades of the emergency NPP. The other nuclear power plants provide the emergency
NPP with all the necessary technical means from their emergency sets and stocks, including
spares, tools, materials and specialized vehicles.
If resources of the operating organization are not sufficient, the NNEGC Energoatom
management has opportunities to involve the following additional resources:− Ministry of Energy and Coal Industry: mobilization of resources to support the
NPP, preparation of a request to provide resources from the state reserve;− Ministry of Emergencies: use of specialized emergency and rescue teams to
respond to an emergency; information exchange with interdepartmental
headquarters and the Government commission for emergency mitigation;
preparation of a request for support in accordance with the Convention on
Assistance in the Case of a Nuclear Accident or Radiological Emergency;− Ministry of Internal Affairs: protection of material values, organization ofcheckpoints to limit the access of vehicles and public to the controlled area andcontaminated territories; organization of free traffic of transport with evacuees
and transport of forces and means for accident mitigation to the NPP; protectionof public order;− Ministry of Defense: support in decontamination of the contaminated territory andtransport, deliver of forces, means and material resources to the accident region
by means of military aviation;− Ministry of Public Health: special and qualified medical assistance to injured
emergency personnel in medical institutions;− Security Service: mitigation of the accident consequences in conditions of athreat or actual terrorist acts.
Each NPP has dedicated services of the Ministry of Emergencies, Ministry of Internal
Affairs, and Ministry of Public Health which arrive at the request of the NPP management for
support and act at the plant site and controlled area.
Dependence on the functions of other reactors on the same site
Emergency procedures for NPP power units envisage the possibility to supply power to inhouse loads of the affected power unit (including the battery recharge system) from one ofthe plant units in operation, automatically switched to in-house power supply mode or
powered from diesel generators of any safety train of any plant power unit (connection
through backup power lines).
Procedures
To mitigate accidents, operating personnel uses emergency operating procedures.
Emergency operating procedures specify personnel actions for safety assurance during
normal operation, design basis and beyond design basis accidents to prevent core damage.
Emergency operating procedures and operating instructions envisage personnel activities
during accidents in the spent fuel pool and Zaporizhzhya NPP dry spent fuel storage facility(DSF). Additional measures on further enhancement of the emergency operating procedures
79

STATE NUCLEAR REGULATORY INSPECTORATE OF UKRAINENATIONAL REPORT ON STRESS TEST RESULTS

for the spent fuel pool and DSF are planned to extend covering the beyond design basis
accidents.
Symptom-based emergency procedures have been recently developed for all Ukrainian
nuclear power units.
At present, the emergency procedures at all Ukrainian nuclear power units include:
1. Procedures for elimination of anticipated operational occurrences. These procedures
are intended for safe elimination of anticipated operational occurrences which have not led tothe conditions of scram and/or setpoints of safety system actuation.
Elimination of operational occurrences involves implementation of activities aimed at thefollowing:− transfer of the reactor into safe state;− exclusion of loss of control over the reactor neutron power and reactor period;− termination of occurrences;− exclusion of impact on personnel and the public;− exclusion of damage to equipment not affected by the operational occurrence;− confinement of possible radioactive releases;− reliable decay heat removal.
Use of the procedures for elimination of anticipated operational occurrences results in oneof the following:− reactor unloading;− stabilization of the reactor parameters and transition to the normal operatingprocedures;− transition to emergency operating procedures.
2. Emergency operating procedures (EOPs). These procedures are intended for efficient
mitigation of emergencies and accidents and prevention of severe accidents.
EOPs are divided into diagnostic actions and actions aimed at the optimum restoration toallow MCR operators to take efficient actions required in each particular situation after the
malfunction is diagnosed.
The accident management process begins with diagnostics of the power unit. The
diagnostics process includes the following main stages:− check actuation of automated systems in case of emergencies;− take actions to stabilize the primary and secondary parameters and transfer thereactor into a safe state;− identify procedures for optimal restoration or procedures for restoration of criticalsafety functions.
Critical safety functions are determined for each of the safety barriers to be constantly
maintained to preserve the integrity of the corresponding barrier. Conditions which ensure
integrity of the safety barriers are controlled on the basis of critical safety functions.
The following priorities (hierarchy) are set among the critical safety functions in EOPs:− subcriticality;− reactor core cooling;− heat removal;− integrity;− containment.
When the critical safety functions are maintained, there is no threat to safety barriers.
EOPs envisage that mitigation of emergencies at one power unit is managed by the Unit
Shift Supervisor; if an emergency occur on two or more power units at one plant site, themanagement is the responsibility of the Plant Shift Supervisor.
The EOPs specify personnel actions during the operational modes: hot shutdown, hotzero power, operation at rated power. At present, under the “Comprehensive (Integrated)
80

STATE NUCLEAR REGULATORY INSPECTORATE OF UKRAINENATIONAL REPORT ON STRESS TEST RESULTS

Safety Improvement Program for Ukrainian NPPs” (C(I)SIP), EOPs are developed for
shutdown states (measures No. 19203, 29203, 39203 “Improvement of the emergency
operating procedures for reduced power and shutdown states”).
3. Severe accident management guidelines (SAMG)
Under the “Comprehensive (Integrated) Safety Improvement Program for Ukrainian
NPPs”, severe accident management guidelines are being developed. The development of
SAMG follows the branch “Program for Analysis of Severe Accidents and Development of
SAMG” PM-D.0.41.491-09.
The main objectives of severe accident management are the following:− termination of core damage at early stages;− maintenance of containment functions for the longest possible period;− minimization of consequences of radioactive releases both on-site and off-site.
Training and exercises
All the operating personnel of the nuclear power plants are obligatorily trained inaccordance with regulations and standards. The training course comprises the following
stages:− professional staffing, psycho-physiological and medical examination, obtaining
permit to work at nuclear facilities;− entry exam to check knowledge level;− professional training in accordance with individual programs;− check of knowledge and obtaining of all the required licenses;− permit for work without supervision and further scheduled retraining including
mandatory emergency and fire-prevention exercises.
All Ukrainian nuclear power plants have training centers equipped with training means
including full-scope simulators (FSS) required for training and skill improvement of thepersonnel.
The MCR personnel are trained on the full-scope simulator to acquire the following
capabilities and skills:− equipment control in normal operation, anticipation operational occurrences andaccidents;− organization of work of subordinated personnel;− interaction with personnel of the MCR and other plant departments.
The list of subjects for FSS exercises also covers accidents that can be caused byexternal hazards.
Emergency training tasks are as follows:− systematic check of personnel’s ability and preparedness for efficient actions inemergencies;− training of skills and abilities to act in accordance with procedures;− training of personnel to prevent emergencies and mitigate accident
consequences;− training of personnel to interact with shift staff, firemen, medical staff, etc.
Every three years nuclear power plants conduct a common-plant emergency exercise
involving departments of the emergency response system at the NNEGC Energoatom
management level. The SNRIU also participates in such exercises.
In the frames of short-term activities under the “Action plan for targeted safety assessmentand further safety improvement of Ukrainian NPPs in the light of the events at Fukushima-1”,
the following emergency exercises were conducted additionally:− 25-26 May 2011, Zaporizhzhya NPP: «General emergency at Zaporizhzhya NPP
caused by extraordinary geological and hydrological conditions in the region of Zaporizhzhya
NPP location, which led to failure of reactor heat removal»;− 29 September 2011, Khmelnitsky NPP: «General emergency at Khmelnitsky NPP
caused by extraordinary geological and hydrological conditions in the region of Khmelnitsky
81

STATE NUCLEAR REGULATORY INSPECTORATE OF UKRAINENATIONAL REPORT ON STRESS TEST RESULTS

NPP location, which led to failure of the NPP main and auxiliary power supply and to failureof reactor heat removal»;− 10-11 November 2011, Rivne NPP: «General emergency at Rivne NPP caused byextraordinary geological and hydrological conditions in the region of Rivne NPP location,
which led to failure of the NPP main and auxiliary power supply and, consequently, to failureof reactor heat removal».
− 24 November 2011, South Ukraine NPP: “Station blackout”.
Emergency training at NPPs was organized at high level. Personnel of the NPPs andinvolved organizations showed their preparedness to act in beyond design basis accidents
and to transfer and maintain the reactor in the safe and controlled condition. Based on theexercises, some measures were developed for further enhancement of the emergency
preparedness and response system.
Plans for improvement of plant site accident management are provided in Section 6.1.4.
6.1.2

Possibility to Use Existing Equipment

Provisions to use mobile devices
Under the safety improvement programs, measures were implemented to ensure theemergency inventory of feedwater and emergency SG makeup in accident conditions, using
fire hoses and mobile pumps (fire trucks), at Zaporizhzhya NPP units 1-6, South Ukraine
NPP units 1-3, Khmelnitsky NPP units 1 and 2 and Rivne NPP unit 3.
The time period necessary to start water supply to the SG from a mobile source is about 1
hour; corresponding exercises of the operating staff of the reactor departments and fire
protection shifts are conducted.
To ensure access of the mobile facilities to the connection places in case of possible
destructions at the NPP site due to external hazards, appropriate mechanisms are foreseen
for clearing access roads.
Provisions for and management of supplies
The reliable power supply systems at all Ukrainian NPP sites envisage reserves of fuel forseven days of work for each emergency diesel generator; the time of design unattended
work for each diesel generator is 250 hours.
Management and limitation of radioactive releases
Accident progression with possible radioactive releases can be divided into the following
stages.
The first stage begins with PORV actuation in response to accidents conditions, resulting
in rupture of the relief tank diaphragm, or LOCA accident. The primary boundaries areaffected and radioactive coolant gets into the containment. Due to pressure increase in thecontainment, radioactive coolant vapors may release into the environment in minor amounts
limited by the design containment leakiness.
The main strategies of radioactive release management at this stage are primary circuit
cooldown via the secondary circuit to decrease the primary parameters lower than setpoints
for PORV actuation and measures aimed at pressure decrease in the containment forcondensation of radioactive vapors. To implement these strategies, it is necessary to restore
functions of the secondary makeup systems and the containment spray system.
The second stage begins after the level in the RPV has decreased and uncovered thecore, leading to increase of fuel cladding temperature. Gas leak defects may emerge andfission products may release from fuel cladding into the primary circuit and containment. The
maximum activity is limited by the coolant activity and the fuel assembly gas gap; release islimited by the design containment leakiness. The main strategies of radioactive releasemanagement at this stage are organization of the primary makeup and measures todecrease the pressure and temperature in the containment.
82

STATE NUCLEAR REGULATORY INSPECTORATE OF UKRAINENATIONAL REPORT ON STRESS TEST RESULTS

The third stage begins after the fuel melting temperature is reached. The maximum
radioactive amount includes the activity of the primary coolant, gas gap and fuel. Release islimited by the design containment leakiness. The main strategies of radioactive releasemanagement are makeup and cooldown of the primary circuit and pressure and temperature
decrease in the containment. During the accident, the greatest importance is placed to therecovery of cooling functions of the containment using the containment spray system. The
spray system allows pressure decrease in the containment and condensation of a significant
part of radioactive aerosols. Pressure decrease in the containment leads to decrease in therelease of non-condensed gases.
The next stage is reaching of the design pressure limits and consequent failure of thecontainment. The strategy of radioactive release management is cooling of the containment
using spray system. The objective is to decrease pressure and condense radioactive vapors
inside the containment. Additionally, there are plans to implement measures for filteredpressure relief from the containment to avoid containment failure due to overpressure.
It can be concluded that in case of an accident, it is possible to use the primary andsecondary makeup systems and the containment spray system. In addition, measures
identified upon the stress tests for accident management are to be implemented.
6.1.3 Evaluation of Factors That May Impede Accident Management andRespective Contingencies
Extensive destruction of infrastructure or flooding around the installation that hinders
access to the site
There is an extensive infrastructure of access roads for different transport – automobile,railway, water transport (for Zaporizhzhya NPP) – for the NPP sites.
Major damage of these infrastructures can potentially occur as a result of an earthquake,
tornado or flooding:− earthquake (to 0.1g) poses no actual danger to roads to the extent that will make
impossible transport operations;− tornado may impede transport communication only locally due to blockage ofroutes that can be eliminated within short periods of time;− flooding will not lead to serious impact on transport communication.
Possible damage to separate buildings and structures designed in accordance withgeneral construction standards is conservatively assumed in stress tests. This assumption
does not influence the unit functioning during an emergency but can lead to some difficulties
in the organization of emergency response actions, including those connected with access tothe site for personnel, mobile pumps and electrical generators (in case they are located offsite).
In the framework of the stress tests, plant walkdowns were performed at all the operating
nuclear power plants. Based on their results, no potential for blockage of access roads to thesites due to destruction of neighboring buildings and structures was identified. It should be
noted that to eliminate blockage, appropriate vehicles and mechanisms are envisaged.
Communication systems (internal and external), loss of communication facilities/ systems
Communication systems ensure redundant communication among the emergency centersof the nuclear power plants, workplaces of the Plant Shift Supervisor, MCR, ECR, radiation
protection control boards. The format of information exchange among the emergency
response participants, the procedure for preparation, registration, transmission and receivingof information, and the procedure for information exchange between the NPP emergency
centers and the operating organization's emergency centers and other interested parties
participating in emergency response are specified in plant procedures for informationexchange among the emergency centers.
Connections of the dedicated telephone channels used for communication are duplicatedby means of commuted telephone channels or other means of communication. To ensure
83

STATE NUCLEAR REGULATORY INSPECTORATE OF UKRAINENATIONAL REPORT ON STRESS TEST RESULTS

reliable connection among the emergency centers and emergency groups and brigades of
the nuclear power plants, mobile radio communication on the basis of VHF connection isenvisaged.
Equipment of the connection systems installed in the reactor and turbine halls has aseismic resistance category corresponding to regulations; it will be operable during designbasis earthquakes.
In terms of possible flooding, the connection wells are protected from water ingress
through roofs and have two leads each. Lower lids of the wells fit tight to the hatchways. The
drainage system is in operable state.
Impairment of work performance due to high local dose rates, radioactive contaminationand destruction of some facilities on site
In planning of emergency measures, potential high dose and radioactive contamination at
the site are taken into account.
To ensure limitation of doses for personnel, a series of technical and organizational
activities is implemented. The main activities on personnel protection are as follows:− administrative management and supervision over radiation health and safety
regulations specified in radiation safety standards to prevent their exceeding andto limit personnel exposure;− determination of personnel protection modes; timely introduction of protective
countermeasures;− radiological surveys in NPP compartments and on-site;− dose monitoring;− provision of emergency personnel with prophylactic radio protective means (radio
protectors and radioresistance means);− personnel sheltering and evacuation;− use of individual protection means.
Modes of radioactive protection of personnel are included in the emergency plan of eachnuclear power plant. The emergency response system has a radiation monitoring group. Its
main tasks are the following:− evaluation of radiation conditions in the compartments, at the plant site,
controlled area and observation area using of types of radiation monitoring data(monitoring of safety barriers, radioactive process monitoring, dose monitoring,radiation monitoring of the environment, radiation monitoring to prevent spread ofcontamination);− evaluation of postulated or actual releases or discharges;− evaluation of pathways of radioactive releases into the environment;− prediction of radiation conditions for the compartments, plant site, controlled area
and observation area taking into account forecasted meteorological conditions;− evaluation and estimation of doses for personnel and the public; preparation ofrecommendations for protection of personnel and the public;− determination and specification of locations of dose monitoring points;− evaluation of optimum routes for personnel movements and evacuation.
In case of an emergency, additional dose monitoring of personnel is implemented andincludes:− monitoring of the working environment – radiation health and safety parameters –at workplaces, in compartments, on the plant site, in controlled area andobservation area;− emergency individual dose monitoring of personnel;− system of timely planning and accounting of individual doses of personnel.
Monitoring of the working environment includes the following:− monitoring of the gamma dose and beta particle flux density;− monitoring of the neutron flux density and/or equivalent dose rate;84

STATE NUCLEAR REGULATORY INSPECTORATE OF UKRAINENATIONAL REPORT ON STRESS TEST RESULTS− monitoring of the activity concentration and nuclide composition of inert
radioactive gases and aerosols in the air of compartments and in releases fromthe ventilation systems;− monitoring of the radionuclide contamination levels of compartment surfaces,
equipment, personnel bodies, personal and working clothes of personnel;− monitoring of the contamination levels of transport, equipment, devices andmaterials transported beyond the restricted access area, buildings and site;− monitoring of collection, removal and decontamination of solid and liquidradwaste;− monitoring of the radionuclide contamination of working clothes and individual
protection means delivered for sanitary treatment;− monitoring of the contamination levels of facilities on the plant site.
For radiation monitoring, the nuclear power plants envisage stationary and mobile
inspection devices. The composition of radiation monitoring instrumentation is provided in the“Radioactive Monitoring Procedures during Operation of NPP Facilities».
Impact on the accessibility and habitability of the main and secondary control rooms,
measures to be taken to avoid or manage this situation
In accordance with regulatory requirements, the design envisages means to ensure
accessibility and habitability of the MCR and ECR during emergencies and accidents.
The following requirements are set for the MCR:
− provide means ensuring MCR habitability and accessibility during normal
operation and accidents;− exclude MCR common-cause failures;− envisage an independent conditioning system for the MCR;
− envisage an intake ventilation system the MCR, with aerosol and iodine filters;− in case of atmospheric air contamination, ensure operation of the conditioning
system in a closed mode;− design supporting ventilation systems (conditioning) for external temperatures+42ºС;− maintain the following air parameters at workplaces during warm seasons(ambient air temperature +31,2 ºС): optimum air temperature +23±2 ºС, relative
humidity 40-60%; tolerable upper level of ambient air temperature in thecompartment +28ºС …+31ºС, relative humidity of 55% at the temperature of+28ºС;− maintain the following parameters in the compartments with I&C instrumentationand equipment:• ambient air temperature +23°С…+25°С and relative humidity ≤80% attemperature of +20°С
• minimum air temperature at the entrance to the compartment not lower
than +14°С;• limiting air temperature in accordance with the technical specification for
I&C instrumentation and equipment not lower than +5°С and not higher than+50°С;− maintain the specified temperature at the MCR in normal operation and during
blackouts;− create increased pressure in MCR for smoke protection, not lower than 20 Pa.
Regulatory requirements set for the ventilation and air conditioning system of the ECR are
similar to those of the MCR specified above.
The capacity of the MCR and ECR ventilation and conditioning systems is accepted
based on heat coming into the compartments from process equipment, artificial lighting,people and through protecting structures.

85

STATE NUCLEAR REGULATORY INSPECTORATE OF UKRAINENATIONAL REPORT ON STRESS TEST RESULTS

The air-conditioning system at the MCR is designed taking into account reliable
maintaining of internal air parameters in the control room compartments in emergency
modes of blackout, under seismic impacts, and hazardous parameters of external air andtaking into account installed equipment. Autonomous conditioners powered from the reliable
power grid are accepted as cooling sources.
Under the “Comprehensive (Integrated) Safety Improvement Program for Ukrainian
NPPs”, measures are being implemented/planned for further enhancement of the systems
ensuring MCR and ECR habitability and accessibility.
Impact on the different premises used by the crisis teams or for which access would benecessary for management of the accident
The means of emergency response at the NPP level include:− MCR and ECR;
− NPP technical support centers;− on-site and off-site crisis centers;− systems and means of announcement and communication;− systems of NPP crisis center data collection, development, documentation,
storage, display and transfer;− NPP emergency set of measuring devices and equipment, individual protectivemeans, decontamination and sanitary treatment means, tools and devices,
special equipment, transport and other emergency and technical means (it isplanned to extend the scope of material and engineering means withconsideration of the events occurred at Fukushima-1).
When protective means and support systems of the on-site crisis center cannot provide
conditions for people vital functions (habitability), the off-site crisis center shall be used.
Continuous emergency response management is ensured by means of providing theacceptability and habitability of at least one of the crisis centers, since the beginning of an
emergency till mitigation of its consequences. The habitability of crisis centers is assuranceof acceptable safe conditions for personnel, including the following: protection against
radiation and chemical factors, fires and smoke formation, ventilation, air conditioning,heating and other required conditions.
Feasibility and effectiveness of accident management measures under the conditions ofexternal hazards (earthquakes, floods)
In planning of activities for management of station blackout and loss of heat removal,
possible destruction on site caused by external hazards is taken into account.
During NPP walkdowns, possible destructions have been identified on the NPP sites.
These destructions may be along the routes of mobile equipment transportation and could
impede potentially the mobile equipment delivery. For the clearance of possible NPP site
blockage that impedes the mobile equipment delivery to the places of equipment connection,
the location of necessary mechanisms within the area for mobile installations is envisaged.
The following specific requirements are set for location of mobile equipment:
1. Mobile diesel generators shall be installed in a seismic-resistant separate building offsite. This approach is based on the following:− Common-cause (flooding, tornado damage, etc.) failure of mobile equipment is
excluded.
− Location of mobile equipment off-site creates an additional way for its delivery (toa certain power unit).
2. Motor pumps shall be installed in a separate seismic-resistant building or directly nearplaces of their connection, in order to provide their quick connection. The conditions forkeeping the mobile equipment:− preservation;− minimum time for its delivery to the place of use;
86

STATE NUCLEAR REGULATORY INSPECTORATE OF UKRAINENATIONAL REPORT ON STRESS TEST RESULTS− readiness for immediate use for the direct purpose:• the storage room shall be heated;• the mechanisms shall be filled up with combustible and oil materials;• for towed mechanisms – a special carrier or organizational measures shallbe envisaged to ensure its continuous readiness for immediate arrival;• the mechanisms without chassis shall be installed on chassis or trailers fortransportation and use of these mechanisms without any loading andunloading;• the mechanisms shall be provided with the required number of spare parts
and intake and pressure piping fixed on chassis.
Unavailability of power supply
To eliminate consequences of accidents related to station blackout, it is required torestore/provide power supply to equipment of safety-related systems needed to perform
safety functions. Each NPP has several possibilities for establishing power supply to theaffected unit from different alternative sources as discussed in detail in Section 5. When
restoration of power supply from regular or alternative sources is not possible, the use ofmobile diesel generators is envisaged. The minimum required power of mobile diesel
generators is determined based on minimum configuration of safe shutdown equipment.
For restoration of equipment of one of the safety system trains (ECCS pumps, pump of
the essential service water supply system, ventilators of the cooling systems of safety systemrooms, etc.), a diesel-generator up to 6kV/2.5 MW connected to group 2 reliable power
supply buses is required (connectors are located in compartments of emergency diesel
generators).
Potential failures of instrumentation
In the framework of equipment qualification, instrumentation and control systems are
qualified for seismic impacts and harsh environments that can emerge during accidents. It
allows ensuring the operability of measuring equipment in emergency conditions.
In the conditions of station blackout and complete discharge of batteries, the following isenvisaged:− primary pressure control with the use of a mobile manometer;− containment pressure control with the use of a mobile manometer;− temperature control in the reactor, main coolant piping with the use of a mobile
millivoltmeter or resistance box on the racks of in-core monitoring system;− level and temperature in spent fuel pools.
Currently, within the framework of the “Comprehensive (Integrated) Safety Improvement
Program for Ukrainian NPPs”, measures on emergency and post-emergency monitoring ofreactor parameters are carried out.
In addition, upon results of stress tests, measures to ensure the operability of
instrumentation and control systems in the conditions of station blackout are carried out:
each train of the emergency power supply system for I&C will be provided with a 300 V/200
kW diesel generator and a 250 kVA isolating transformer, 380/220 V.
Potential effects from the other neighboring installations at site, including considerations ofrestricted availability of trained staff to deal with multi-unit, extended accidents
There are the following significant potential effects from adjacent units:− deterioration of radiation conditions on site in case of an emergency at several
power units. The deterioration of on-site radiation safety shall be consideredduring planning of emergency activities (Section 6.1.3.);− increase of the need for technical resources and manpower for accident
management at several power units. The system of emergency preparedness
envisaged the mobilization of additional resources of the operating organization(Section 6.1.1).
87

STATE NUCLEAR REGULATORY INSPECTORATE OF UKRAINENATIONAL REPORT ON STRESS TEST RESULTS

6.1.4 Conclusions on the Adequacy of Organizational Issues for AccidentManagement
Symptom-based emergency procedures were implemented at NPP units. Actions of
personnel are aimed at prevention of severe core damage. Emergency plans have been
introduced at NPPs and at the level of the operating organization.
An efficient accident management system was created, which includes the required
administrative and technical measures, means and resources to prevent and limit accident
consequences. External technical support is ensured in accident management at the branchand national levels to mobilize additional human and technical resources.
Measures for improvement of NPP accident management are provided in Section 6.1.5.
6.1.5 Measures That Can Be Envisaged to Enhance Accident Management
Capabilities
The stress tests confirmed the importance of short-term completion of measuresenvisaged in Section 6 “Accident Management” of the current “Comprehensive (Integrated)
Safety Improvement Program for Ukrainian NPPs”:− improvement of emergency operating procedures for shutdown states;− implementation of severe accident analysis and development of SAMG.
In addition, the stress tests determined the need to implement the following:− develop measures for spent fuel pool severe accident management, together withrespective analytical substantiations;− implement measures based on results of emergency training including measuresconcerning the accessibility and habitability of MCR (ECR) and crisis center insevere accidents).
6.2 Accident Management Measures in Place at the Various Stages of a Scenario
of Loss of the Core Cooling Function
6.2.1 Before Occurrence of Fuel Damage in the Reactor Pressure Vessel(Including Last Resorts to Prevent Fuel Damage)The measures on accident management to prevent severe core damage are determined
in EOPs (Section 6.1.2).
The EOPs include the optimal restoration procedure АRZ-0.0 “Loss of AC power”. This
procedure determines actions in a case of loss of AC power for all 6 kV buses of safetysystems (BV, BW, BX) as well as actions on reactor stabilization in blackout conditions.
Personnel are required to make attempts to supply power to safety system buses fromalternative sources.
The procedures VFT-1.1 “Loss of secondary heat removal” and VFZ-1.1 “Reactor core
overheating” determine actions on restoration of reactor conditions in case of loss of heatremoval in all SGs and actions on core cooling restoration.
If pressure in the containment increases to the values above the established limits, theactions of personnel are determined by the procedure VFG-1.1 “High pressure incontainment”.
The actions according to EOPs allow personnel to prevent or substantially extend the time
available to severe core damage (if the severe core damage cannot be prevented).
If the actions according to the EOPs are not successful, accident management proceeds
in compliance with emergency plans and severe accident management guidelines (SAMG).
6.2.2

After Severe Core Damage before Failure of the Reactor Pressure VesselCore degradation (melting) is one of the most significant effects of severe accidents. In
case of loss of heat removal accidents, melting occurs as a consequence of the lack of
coolant (heat sink is not available) in the reactor core. Loss of coolant can be a consequence
88

STATE NUCLEAR REGULATORY INSPECTORATE OF UKRAINENATIONAL REPORT ON STRESS TEST RESULTS

of an initiating event (primary leak) as well as the result of its evaporation (accident withintegral primary circuit, including station blackout and/ or loss of ultimate heat sink).
There are two main phases of severe accident progression till failure of reactor vessel
bottom: early phase (initial heating and melting of the reactor core structures) and late phase(formation of extensive blockade, origination and relocation of melts and reactor bottom
heating).
At early accident stage, irrecoverable primary coolant loss and consequent core drying
occur. Core uncovering leads to increase in fuel temperature (because fuel assembly coolingby steam is not sufficient to avoid core melting). As a result, the initial core deformation(swelling and failure of fuel assembly cladding) occurs. Besides, temperature increase the inreactor core leads to initiation of the steam-zirconium reaction. The heat generated in thisreaction is comparable to the decay heat, and intensity of temperature increase for fuelassembly claddings after the beginning of zirconium oxidation rises substantially.
If temperature further increases, local melting of fuel cladding can occur in the reactor
core. As a result, “drops” of molten material can form. When some of them flow into thelowest part of the reactor core, molten materials may harden and lead to blockage of open
flow areas and clearances between fuel assembly claddings.
In order to prevent reactor vessel failure and melt flow into the containment as well as for
mitigation of consequences of the severe accident at in-vessel phase, it is necessary to
perform actions on accident management.
The SAMG that meet up-to-date knowledge of severe accident progression are currently
under development within the framework of the “Comprehensive (Integrated) Safety
Improvement Program for Ukrainian NPPs” and in accordance with the industrial “Programon severe accident analysis and SAMG development”.
Currently, major efforts on severe accident analysis and SAMG development have been
completed:
Vulnerability analysis for all types of reactor plants that are in operation in Ukraine(WWER-1000/V320, WWER -1000/V302 и WWER -440/V-213), including:− development of guidelines on vulnerability analysis and analytical substantiation
for severe accident management strategies;− determination and substantiation of a list of accidents with severe core damage,requiring a detailed analysis;− analysis of the selected list of severe accidents;− analysis of radiation consequences for the selected list of severe accidents;− determination and preliminary substantiation of severe accident management
strategies.
Analytical substantiation and SAMG development are carried out. These efforts include:− development of a set of guidelines on the format and structure of SAMGs,
verification and validation and development of general provisions on severe
accident management;− analytical substantiation of SAMG;− technical substantiation of SAMG;− analysis of radiation consequences of severe accidents with consideration ofsevere accident management strategy implementation;− SAMG compiling and validation.
In the framework of the performed vulnerability analysis, severe accident progression has
been analyzed and severe accident management strategies have been identified. The
following strategies have been specified for accident management at the stage till reactor
pressure vessel failure:− primary coolant injection;− primary pressure decrease;− SG makeup;
89

STATE NUCLEAR REGULATORY INSPECTORATE OF UKRAINENATIONAL REPORT ON STRESS TEST RESULTS− SG pressure decrease;− external cooling of RPV.
Primary coolant injection
The main objectives of this strategy are:− heat removal from the reactor core (from debris) by means of long-term watersupply into the primary circuit;− prevention of reactor pressure vessel failure (or increase of time margin tillreactor pressure vessel failure);− reactor core flood with the purpose of fission product deposition/confining.
The configuration of equipment that can be used for implementation of the mentioned
strategy depends on power supply availability. In case of power supply availability, thefollowing ways of water supply into primary circuit are possible: HPIS pumps, LPIS pumps,
makeup system pumps.
In case of station blackout, addition measures are needed to implement this strategy. Useof mobile equipment for primary coolant injection and melt cooling has to be justified.
Primary pressure decrease
The main objectives of this strategy are:− prevention of damage to SG tubes and reactor coolant system;− prevention of corium flow from the reactor core under high pressure;− flow rate reduction through the leak in case of containment bypass;− conditions for LPIS operation.
The configuration of equipment that can be used for implementation of the mentioned
strategy depends on power supply availability. In case of power supply availability(restoration), the primary pressure can be decreased by opening of PORV and/or valves ofthe emergency gas evacuation system. In case of blackout, the time for this strategy
implementation will be limited by battery discharge.
SG makeup
The main objectives of this strategy are:− heat removal from the primary circuit;− prevention of temperature-induced failures of SG tubes;− retention of fission products that appear in steam generators via tube leakages.
The configuration of equipment that can be used for implementation of the mentioned
strategy depends on power supply availability. If power supply is available (or restored),water supply to SG is possible from regular systems:− auxiliary feedwater pump and/or emergency feedwater pump (ZNPP, KhNPP,
SUNPP units and RNPP units 3-4);− auxiliary feedwater pump, feedwater pump or auxiliary emergency power supply
system (RNPP units 1-2).
In case of blackout or failure of regular systems of SG makeup, coolant supply to SG
secondary circuit shall be accomplished from the following systems:− passive feedwater supply from turbine hall deaerators (WWER-1000);− pump of the condensate storage tank;− fire pumps;− fire engines.
Passive steam generator makeup means SG pressure decrease to the value below thepressure in feedwater line to discharge water from deaerator to SG. SG pressure can be
reduced through BRU-A or SG safety valve, i.e. time margin for this strategy is limited by thecapacity of batteries. Water supply to SG from the pump of the condensate storage tank orfire pumps is possible if SG pressure is close to the atmospheric pressure.
90

STATE NUCLEAR REGULATORY INSPECTORATE OF UKRAINENATIONAL REPORT ON STRESS TEST RESULTS

SG pressure decrease
The main objective of this strategy is to promote conditions for water supply to the SG.
(This strategy is especially relevant if water supply to SG secondary circuit is envisaged fromalternative sources, for example, fire pumps, deaerator). The configuration of equipment
needed for implementation of this strategy depends on power supply availability. In case of
blackout, secondary pressure can be decreased through BRU-A or SG safety valves.
In case of power supply availability, BRU-K can be used (if vacuum is in turbine
condenser).
External cooling of RPV
The objective of this strategy is the organization of heat sink from molten fuel due to thecooling of the reactor bottom outer surface. There are plans to perform a detailed analysis of
the possibility of external cooling of RPV and implementation of respective technicaldecisions. It will be necessary then to modify the reactor cavity and investigate thepossibilities for steam removal from the reactor cavity with use of available equipment.
6.2.3

After Failure of the Reactor Pressure Vessel

After reactor vessel failure, the melt would relocate to the reactor cavity where the molten
corium–concrete interaction (MCCI) begins. As a consequence of this interaction, thefollowing failures may occur:− loss of containment integrity as a result of static pressure increase in containment(containment overpressure);− loss of containment integrity as a result of hydrogen detonation;− containment bypass as a result of melting of ionizing chamber channels (WWER1000/V-320);− containment bypass as a result of the “failure” of penetrations located on the floorof room А201 (WWER-1000/V-302/338);− melt-through of the sealed door and melt release outside the containment(WWER-440);− containment failure as a result of melt-through of the containment lining and/ortransport hatches at elevation 13.7 m after melt release outside the room GA301(WWER-1000/V-320).
The main tasks of severe accident management after reactor pressure vessel failure are:− decrease of containment parameters to limit radioactive release to atmosphere;− radionuclide deposition from containment atmosphere;− corium heat removal outside the reactor pressure vessel to terminate
corium/concrete interaction;− prevention of hydrogen detonation in the containment.
A detailed description of the strategies intended to maintain the containment integrity isprovided below (Section 6.3).
6.3 Maintaining the Containment Integrity after Occurrence of Significant Fuel
Damage6.3.1

Elimination of Fuel Damage/Meltdown in High Pressure

In the course of loss of heat removal, irrecoverable loss of primary coolant occurs (as aresult of leak through the primary piping rupture or due to pressurizer PORV operation), andthe core is consequently dried out. Reactor core uncovering leads to fuel temperature
increase (because fuel cooling by steam is not sufficient to prevent the core from melting).
This leads to initial core deformation (swelling and failure of fuel claddings) and severe
damage (melting) of fuel assemblies. In case of loss-of-coolant accidents with integral
primary circuit, core melting can occur under high pressure.

91

STATE NUCLEAR REGULATORY INSPECTORATE OF UKRAINENATIONAL REPORT ON STRESS TEST RESULTS

Further progression of a severe accident with core melting under high pressure can finallylead to corium release to the containment under high primary pressure, and so-called effectof direct containment heating (DCH) may occur. Very fast heating of the steam and gas
mixture in the containment is governed by a complex effect of several processes (primarycoolant release, intensive heat transfer from melt fragments, exothermic reactions of metaloxidation and hydrogen burning) can result in temperature and pressure jump in thecontainment. If the pressure is above the containment design limit for strength, containment
failure can occur. Such a failure would occur immediately after reactor pressure vessel
damage and core melting fragment spreading within the containment. This failure would leadto a significant radioactive release beyond the containment.
Although PSA-2 for Ukrainian NPPs showed that the contribution of the above-mentioned
phenomenon to failure probability is minor, the reactor core damage under high pressuremust be prevented because of a probable failure of the primary equipment as a result ofhigh-temperature creep (so-called temperature-induced failure). In case of temperatureinduced failures of SG tubes, the containment bypass and radioactive release to atmospherecan hypothetically occur.
Primary pressure can be decreased using pressurizer PORVs, emergency gas
evacuation system and by means of secondary cooldown.
In the framework of stress tests, effectiveness of accident management actions according
to EOPs before severe core damage was analyzed. The results of calculations have shown asignificant increase in time margin before severe core damage and revealed no conditions
for temperature-induced failure of SG tubes and/or corium release to the containment underhigh pressure.
6.3.2

Management of Hydrogen Risks inside the Containment

Accumulation of inflammable gases in high concentrations during a severe accident withsubsequent potential deflagration and detonation is the most specific contributor tocontainment damage for different plant types (PSA-2 for Ukrainian NPPs also confirmed theimportance of this issue).
Significant amount of hydrogen and other inflammable non-condensable gases isgenerated and accumulated inside containment compartments during severe accidents. The
amount of hydrogen accumulated during an accident is one of the main parameters thatcharacterize the accident progression. Accumulation of significant amounts of inflammablegases in the containment is associated with danger of their combustion and explosion that
may result in static and dynamic stresses that are higher then the containment design limit
for strength or even the containment ultimate capacity and may lead to containment failure.
In the framework of the stress tests, extensive calculations were performed to investigatehydrogen danger, including:− analyses to investigate issues of hydrogen generation and distribution inside thecontainment;− analyses to investigate possibilities to reduce hydrogen concentration inside thecontainment.
Calculations for station blackout combined with loss of ultimate heat sink were carried out
for the three types of reactors (WWER-1000/V320, WWER-1000/V302 and WWER-440/V213).
In investigating the possibilities to reduce hydrogen concentration inside the containment,
several calculation analyses were carried out and involved modeling of operation of passive
autocatalytic hydrogen recombiners (PAR). The simulation of PARs as means of hydrogenconcentration reduction in the containment is based on the fact that to date a considerable
scope of studies in this area has been performed for Ukrainian NPPs. Based on thesestudies, a decision was made that PAR is the most appropriate applicable mean of hydrogenconcentration reduction. Therefore, a pilot conceptual technical decision was developed for92

STATE NUCLEAR REGULATORY INSPECTORATE OF UKRAINENATIONAL REPORT ON STRESS TEST RESULTS

implementation of the hydrogen removal system to ensure hydrogen explosion safety during
beyond design basis accidents for WWER-1000/V-302, V-338.
The calculated amounts of hydrogen generated during the accident “blackout combinedwith loss of ultimate heat sink” for WWER-1000 vary from 2.5 to 3.0 t significantly dependingon the composition of RPV concrete (assessed as 3.8 t for SUNPP unit 3) and for WWER440 is about 2 t.
Generation of this considerable hydrogen amount results in high hydrogen concentrations
accumulating in the containment (over 15%); however, in accordance with the Shapiro
diagram, hydrogen detonation conditions are not reached because of high concentrations ofsteam (over 60%) and low oxygen concentration.
Considerable hydrogen amounts accumulate in the containment while the existing tools
are not intended to cope with such amounts of hydrogen generated in severe accidents(passive autocatalytic hydrogen recombiners are installed at RNPP units 1,2, 3 and KhNPP
unit 2 to reduce hydrogen concentration during design-basis accidents). Therefore, apotential hazard of detonation exists (for example, in case of steam condensation resulting
from the recovery of spray system operability).
Under the “Comprehensive (Integrated) Safety Improvement Program for Ukrainian
NPPs”, the following measures are ongoing to enhance hydrogen safety:− implementation of measures on hydrogen concentration reduction in thecontainment during beyond design basis accidents;− implementation of the hydrogen concentration monitoring system in thecontainment for beyond design basis accidents;− implementation of the hydrogen concentration monitoring system in SG and MCP
compartments (А201) and in pressurizer compartments (А527/1).
Conceptual technical decision was also developed for implementation of the hydrogen
removal system ensuring hydrogen explosion safety during beyond design basis accidents
for WWER-1000/V-302, V-338.
According to the technical decision, in order to reduce the hydrogen concentration incontainment during beyond design basis accidents (including accidents with severe coredamage), passive autocatalytic hydrogen recombiners are expected to be installed in thecontainment.
Therefore, taking into account the information stated above, it can be concluded thatUkrainian NPPs pay proper attention to hydrogen safety issues. These efforts are highly
important and should be accelerated.
6.3.3

Prevention of Containment Overpressure

The containment spray system is intended for prevention of containment failure due tooverpressure at power units of Ukrainian NPPs. The spray system is used for:− reduction of pressure inside the containment in case of primary and/or secondary
piping break;− binding of iodine isotopes in the containment in case of loss-of-coolant accident;− emergency feeding of spent fuel pools (for WWER-1000/320).
The spray system consists of three functional groups. Each group has independent
process communications, I&C equipment and interlocks and normal and emergency powersources. Each functional group of the spray system includes the following main equipment:− spray pumps intended for boron solution supply;− water-jet pump for potassium borate supply to spray pumps;− emergency cooling heat-exchanger, that is shared between the spray systemtrain and the low-pressure injection system train;− emergency boron solution storage tank (for WWER-1000/V320 – compartment
GA-201 inside the containment);− spray nozzles.
93

STATE NUCLEAR REGULATORY INSPECTORATE OF UKRAINENATIONAL REPORT ON STRESS TEST RESULTS

In addition to the containment spray system, the containment of RNPP power units 1-2(WWER-440/V213) is provided with passive steam condenser (“passive” spray) to limit peakpressure in compartments through condensation of steam generated during an accident andto bind airborne iodine and confine radioactive products.
The passive steam condenser consists of a number of trays and casings with tunnelingcaps that are installed as cascade along the building height. Trays are filled with boric acidsolution (16 g/kg) up to the nominal level. The steam condenser tower is joined with SG box
via two corridors.
Results of severe accident analyses performed previously in the framework of vulnerability
assessments and stress tests revealed a potential for considerable pressure increase in thecontainment.
The acceptance criterion for pressure in the WWER-1000 containment is conservatively
assumed as 5 kgf/cm2 (abs) (0.49 MPa), that complies with design containment pressure
limit. According to strength calculations performed in PSA-2, pressure value for containment
failure is ∼0.83 MPa.
According to calculations performed in framework of stress tests for WWER-1000/V302338 units, the containment pressure reaches 5 kgf/cm2 in ∼41 hours after accident beginning.
For WWER-1000/V-320 units, it occurs in ∼27 hours. For WWER-440/V-213, the acceptancecriterion is not exceeded. Since this acceptance criterion is conservative, the actual available
time to containment failure is much longer and sufficient to implement the strategy forpreventing containment failure.
Prior to completion of the stress tests, the SNRIU established requirements for
implementation of measures on forced filtered pressure relief from the containment for
WWER-1000 units (containment venting). The “Comprehensive (Integrated) Safety
Improvement Program for Ukrainian NPPs” was supplemented with additional measures,
including:− development and implementation of a technical decision on controlled filteredcontainment venting;− development of a procedure for emergency containment venting in case of asevere accident, and its incorporation into SAMG.
The technical decision being developed should provide for:− necessary calculations that prove effectiveness of the containment pressure
decrease, effectiveness and feasibility of discharged steam-gas treatment,
considering minimization of radioactive contamination of the environment;− possibility to operate the system under station blackout.
A conceptual technical decision “Implementation of emergency containment venting at
South Ukraine NPP units 1,2” has been developed.
Results of the calculation analyses performed in stress tests showed the possibility andeffectiveness of this pressure discharge strategy.
6.3.4

Prevention of Re-criticality

The re-criticality in normal operation and accidents is prevented by means of:− control rod insertion into the core;− primary shutdown boron concentration.
Re-criticality may appear due to injection of non-borated water in a partially degraded core(reflooding). Accident management strategies of melt flooding (in- and ex-vessel) suggested
for SAMG, and measures proposed based on stress tests results envisage supply to reactor
of borated water only. The results of stress tests showed that the plants have inventories ofborated water that may be used for implementation of these strategies.
Any new strategies or modifications associated with injection of non-borated water, forinstance, as a latest measure to terminate the core degradation, should be subject todetailed analysis of the re-criticality issue. Such analyses should take into account94

STATE NUCLEAR REGULATORY INSPECTORATE OF UKRAINENATIONAL REPORT ON STRESS TEST RESULTS

uncertainties in the knowledge about the core state at the beginning of reflooding as well as
in the behavior of the fuel rods during a severe accident.
6.3.5

Prevention of Basemat Melt-throughAccording to calculations performed in the framework of the stress tests, the time toreactor pressure vessel failure for WWER-1000/V302-338 and WWER-1000/V-320 is ∼23-24
hours. For WWER-440/V-213, additional efficient measures (additional emergency feedwater
system, see Section 5) have been implemented to prevent (substantially extend time to)severe core damage and consequent reactor pressure vessel failure.
After reactor vessel failure, corium penetrates into the reactor cavity where it starts
interacting with concrete (MCCI). This may lead to the following containment failures andpathways of fission product releases to the environment:− containment bypass due to melt-through of ionizing chambers (for WWER1000/320);− containment bypass due to failure of penetrations located on the floor of А201
compartment (for SUNPP units 1-2);− sealed door melt-through and melt penetration to compartments outside thecontainment (for RNPP units 1-2);− containment failure due to melt-through of containment cladding and/or transporthatches on elevation 13.7 m after melt spread outside the GA301 compartment(for WWER-1000/320).
Results of PSA-2 for Ukrainian NPPs showed that the dominant types of containment
failures at late stage are caused by melt-through of containment structures.
Based on the vulnerability analyses for severe accident conditions, a strategy of corium
cooling in the reactor cavity was developed. The purposes of the strategy are:− corium cooling in the reactor cavity;− prevention/minimization of hydrogen generation and generation of othercombustible gases due to MCCI;− prevention of containment failure due to melt-through of the floor in the А301
compartment and corium ingress to the А201 compartment with subsequent
melt-through of the floor in this compartment and containment integrity
degradation (for WWER-1000/302(338));− prevention of potential containment bypassing through ionization chamber trains(for WWER-1000/V320);− prevention of sealed door failure and corium penetration to non-hermetic
compartments (for WWER-440/В213);− prevention of basemat melt-through.
Corium cooling is possible in case if coolant is supplied into the reactor cavity by ECCS
pumps. Measures on corium ex-vessel cooling and retaining inside the containment are
currently underway. One of the measures foreseen in the C(I)SIP is “Containment integrity
preservation in case of its interaction with corium (core melt) during external stage of severe
accident”.
6.3.6

Power Sources Necessary for Protecting Containment Integrity

Operability of the following equipment is to be ensured to preserve the containment
integrity in accordance with developed severe accident management strategies:− containment isolating valves;− spray system;− hydrogen concentration reduction system (if PARs are used, there is no need forelectric power and compressed air supply);− containment venting;− reactor cavity melt cooling system.
95

STATE NUCLEAR REGULATORY INSPECTORATE OF UKRAINENATIONAL REPORT ON STRESS TEST RESULTS

In case of a station blackout accident, operability of the systems will be provided by:− compressed air system and air-operated valves;− emergency diesel generators;− common-unit emergency diesel generators;− other electric power sources in case of blackout, including mobile installations(described in Section 5).
6.3.7 Measuring and Control Instrumentation Needed for Protecting
Containment Integrity
To implement strategies on containment integrity preservation, the following parameters
shall be measured:− containment water level,− pressure in the containment,− hydrogen concentration in the containment,− temperature in the containment,− fission product release to the containment (containment radiation level).
Besides, additional indicators (in terms of their importance for severe accident
management strategies) to be monitored for the strategies are:
− activity in steam line (to assess possibility of environmental release of fission
products in case of containment bypass);− position of valves on containment penetrations;− containment isolation condition;− water level in low-pressure injection system tanks;− release of fission products to the environment (NPP radiation level).
Analysis of measuring instrumentation at Ukrainian NPPs shows that it is sufficient for the
majority of these strategies.
In addition, several measures are being implemented under the “Comprehensive(Integrated) Safety Improvement Program for Ukrainian NPPs” for accident and postaccident monitoring of reactor parameters (Section 6.3.10).
6.3.8 Capability for Severe Accident Management in Case of Simultaneous Core
Melt/Fuel Damage Accidents at Different Units on the Same Site
In case of a severe accident at several power units on-site, the NNEGC Energoatom
emergency response system envisages mobilization of operating organization resources,
including mobilization of personnel and means from other NPPs and subordinatedenterprises. If necessary, NPPs form additional shifts for emergency response teams andbrigades to arrive at NPP in emergency, engaging staff of emergency response teams andbrigades from other NPPs. NPPs provide the affected NPP with necessary material andtechnical means from their own emergency sets and spare part stocks, instruments,
materials, special equipment.
External support in case of emergency situations which cannot be managed by forces of
the affected NPP is addressed in detail in Section 6.1.1.
6.3.9 Conclusion on the Adequacy of Severe Accident Management Systems forProtection of Containment Integrity
Information concerning the strategies for severe accident management is provided in
Sections 6.2.2 and 6.2.3. The following strategies were identified for severe accident
management:
1.
Coolant injection into the primary circuit;2.
Primary pressure decrease;3.
SG makeup;
4.
SG pressure decrease;5.
Injection into the containment;
96

STATE NUCLEAR REGULATORY INSPECTORATE OF UKRAINENATIONAL REPORT ON STRESS TEST RESULTS

6.
7.
8.
9.

Hydrogen concentration control in the containment;
Containment venting;External reactor cooling;
Corium cooling in the reactor cavity.

Strategies No. 5-7 and 9 directly refer to the containment integrity preservation.
Analysis of the developed strategies permits a conclusion that there are necessary
technical means needed for implementing most strategies. Additional measures are needed
for the following strategies:− hydrogen concentration control in the containment;− containment venting;− corium cooling in the reactor cavity.
For implementation of these strategies, measures are envisaged under the“Comprehensive (Integrated) Safety Improvement Program for Ukrainian NPPs” (see Section
6.3.10).
6.3.10 Measures Which Can Be Envisaged to Enhance Capability to Maintain
Containment Integrity after Occurrence of Severe Fuel Damage
The following measures are ongoing under the “Comprehensive (Integrated) Safety
Improvement Program for Ukrainian NPPs” for severe accident management (including
measures for containment integrity preservation after severe core damage):− SAMG development and substantiation;− implementation of filtered containment venting in case of severe accidents;− implementation of measures for hydrogen concentration reduction in thecontainment in case of beyond design basis accidents;− implementation of hydrogen control system in SG and MCP compartments(А201) and in pressurizer compartment (А527/1);− implementation of hydrogen concentration monitoring system in the containment
for case of beyond design basis accidents;− preservation of the containment integrity in case of interaction with corium (active
core melt) at the ex-vessel phase of severe accident;− development and implementation of measures for diagnostics in case of severe
accident.
The above-mentioned measures will allow prevention of the main types of containment
failures:− containment failure due to overpressure;− containment failure due to hydrogen explosion;− containment failure due to MCCI.
6.4 Accident Management Measures to Restrict the Radioactive Releases
6.4.1 Radioactive Releases after Loss of Containment Integrity
Section 6.2 of the report describes strategies on severe accident management to preventthe main severe accident phenomena or to mitigate their consequences to:− terminate core damage at early stage;− maintain the containment function as long as possible.
Containment integrity failure can occur in case of unsuccessful implementation of thestrategies described above. Three main types of containment integrity failures are possible:− containment bypass (as a result of primary-to-secondary leak or as a result of
temperature-induced failure of SG tubes);− failure of containment isolation;− containment failure.
In case of containment bypassing, the following measures must be implemented:− reduction of primary pressure;97

STATE NUCLEAR REGULATORY INSPECTORATE OF UKRAINENATIONAL REPORT ON STRESS TEST RESULTS− injection of coolant into the secondary circuit at affected SG.
In case of an accident with containment failure, measures must be focused on:− fission product deposition from containment atmosphere;− containment pressure decrease to reduce pressure drop between thecontainment and environment.
An efficient way to reduce radioactive releases to the environment is long-term operationof the containment spray system. As a result of the containment spray system operation,pressure and temperature will decrease owing to steam condensation, that will lead to
reduction of leak from the containment and, consequently, will lead to reduction of fission
product releases to the environment. Besides, fission products from the containment
atmosphere will be deposited due to the spray system operation.
6.4.2 Accident Management after Uncovering of the Top of Fuel in the CoolingPool
In case of blackout, spent fuel pool cooldown pumps will trip, leading to termination ofcooling water circulation through the spent fuel pool. Water inventory above fuel assemblies
allows establishing natural circulation in the spent fuel pool. Decay energy heats spent fuelpool water, resulting in water boiling and gradual water level decrease.
Decrease of the water level below the fuel part of assemblies leads to gradual heating offuel claddings and zirconium-steam reaction with hydrogen generation and release ofadditional energy that is commensurable with fuel decay heat. Further heating of fuelelements leads to their severe damage. After complete dry-out of the spent fuel pool, its
lining is damaged and corium starts interacting with concrete floor structures of the spent fuelpool, leading to generation of hydrogen and other noncondensable gases and resulting inspent fuel pool floor melt-through.
Conservative calculation analyses were performed under the stress tests for the most
severe accident scenarios. According to the calculations, time was assessed for melt-throughof the spent fuel pool concrete floor structure, which is more than 1 day for WWER-1000 pooland more than 2 days for WWER-440 pool. The calculated time available before spent fuelpool damage is sufficient for emergency measures.
Also, the results of calculation analyses showed that during a severe accident in the spent
fuel pool, the amount of hydrogen generated is comparable with the hydrogen amount
generated in case of a severe accident (see Section 6.3.2). The methods of reducing thehydrogen concentration resulting from spent fuel pool severe accident are the same as
described in Section 6.3.2. the calculated hydrogen amount generated in the spent fuel poolin case of a severe accident is about 2200-3800 kg.
It should be noted that effective measures were developed to prevent spent fuel poolsevere accidents, including water supply from mobile facilities. In addition to the planned
measures, guidelines for personnel actions on spent fuel pool severe accident management
are under development.
6.4.3 Conclusions on the Adequacy of Measures to Restrict the Radioactive
Releases
The strategies on severe accident management include personnel actions to limit
radioactive releases. In case of severe accident progression with containment integrity
preservation, the containment performs functions of radioactive release limitation.
In case of containment failure, an efficient strategy for limitation of radioactive releases tothe environment envisages containment spray system operation.

98

STATE NUCLEAR REGULATORY INSPECTORATE OF UKRAINENATIONAL REPORT ON STRESS TEST RESULTS

7. GENERAL CONCLUSIONS
7.1 Safety Margins
The stress test results were represented at the open session of the SNRIU Board on 2425 November 2011. The session was attended by representatives of non-governmentalorganizations, mass media, Secretariat of the Cabinet of Ministers of Ukraine, dedicatedcommittees of the Supreme Council of Ukraine, Ministry of Energy and Coal Industry of
Ukraine, regional state administrations and regional councils, as well as representatives ofnuclear regulatory authorities of Bulgaria, Germany, Russian Federation and Slovak
Republic.
Upon presentation of stress test results, the following was pointed out:
− the sequence of events that occurred at Fukushima-1 is impossible for Ukrainian
NPPs. Safety improvement measures implemented at Ukrainian NPPs for the last
10-15 years have greatly reduced the probability of core damage and radioactive
releases;− analysis has revealed no new crucial external natural hazards or combinations ofhazards additional to those considered in NPP design and analyzed in detail in
NPP safety analysis reports.
Earthquake
The operating NPPs were designed using the conservative principle, they are robust
against design-basis hazards and have appropriate safety margins.
The seismic impact that established in design of the operating Ukrainian NPPs is
accepted as follows: design earthquake with intensity of 5 and maximum calculated
earthquake with intensity of 6 on the MSK-64 scale (peak ground accelerations of 0.025g
and 0.05g, respectively).
Additional seismic investigations completed on sites (ongoing at the Zaporizhzhya NPPsite) confirmed the design-basis seismicity of the Rivne and Khmelnitsky NPPs (2000-2002)
and determined the peak ground acceleration (0.093g) for the South Ukraine NPP (20092010).
The structures of category I5 of all NPP units (containment, reactor building, emergency
diesel generators, essential service water spray ponds) and category 2 (including turbinehall) are resistant to design-basis seismic impacts. Category I structures have safety margins(at least 0.1g).
The following safety margins were determined for the containment:− 0.185g for WWER-440 (technical state assessment in the framework of Rivne-1,2
long-term operation activities);− 0.17g for WWER-1000/V-320 (assessment in the framework of stress tests);− 0.15g for WWER-1000/V-302, 338 (technical state assessment in the frameworkof South Ukraine-1 long-term operation activities).
The equipment and piping required to perform the main safety functions are robust
against the design-basis seismic impacts; the main reactor equipment and piping and safetysystems have safety margins.
Seismic qualification of equipment is ongoing. The value of 0.1g was conservatively
accepted in qualification according to IAEA recommendations (0.12g for the South Ukraine
NPP with account of engineering margin).

5

Category I includes buildings and structures whose failure or damage can affect safety-related normal operation
systems and thus cause radioactive releases in amounts that may lead to exposure of personnel and the public toradiation exceeding the established doses for the maximum design-basis accident or cause failure of safetysystems that maintain the reactor core subcriticality, ensure reactor heat removal and confine radioactive
materials

99

STATE NUCLEAR REGULATORY INSPECTORATE OF UKRAINENATIONAL REPORT ON STRESS TEST RESULTS

The structures and components of the spent fuel pools at Ukrainian NPPs are robust
against design-basis seismic impacts and have safety margins (0.1g).
The structures and components of the dry spent fuel storage facility (DSF, Zaporizhzhya
NPP) are designed to withstand seismic impact with 0.2g ground acceleration.
Detailed information on safety margins for seismic impacts is provided in Section 2.2 ofthis Report.
Flooding
There are no direct risks of flooding, including those resulting from failure of hydraulicstructures caused by an earthquake. The safety margins are as follows:− Zaporizhzhya NPP. The maximum possible level in the Kakhovka reservoir in case of
the worst scenario of failure of the Dnipro river dams will be 19.4 m, which is lower thanthe leveling elevation of the Zaporizhzhya NPP site (22.0 m).
− Khmelnitsky NPP. The leveling elevation of the Khmelnitsky NPP site and the coolingwater reservoir dam top constitute 206.0 m, while the maximum level of a flooding wave
in case of failure of the dam is 203.0 m.
− Rivne NPP. The leveling elevation of the Rivne NPP site is 188.5 m and the maximum
water level of the Styr river is 164.4 m.
− South Ukraine NPP. The leveling elevation of the South Ukraine NPP site is 104.0 m.
Rise of the water level in the Yuzhny Bug river does not pose a hazard since it is 70 m
lower than the site location. The water level in the Tashlyk reservoir may reach 101.5m.
Tornado
The tornado impact on category I buildings and structures of all Zaporizhzhya,
Khmelnitsky, Rivne and South Ukraine NPP units was analyzed taking into account windfrontal pressure, pressure drop and flying missiles.
The tornado frontal pressure values calculated on the basis of statistical data are in therange from 6.0 to 12.0 kPa for all NPP sites and are substantially lower than shock wave
impact with frontal compression pressure ∆Р = 30 kPa (design value).
The pressure drop of 6.4-10.3 kPa under tornado impacts calculated on the basis ofstatistical data is lower than 8.1-10.9 kPa conservatively accepted in the safety analysis
reports for such loads.
Tornadoes that may occur in Ukraine do not pose hazards for NPP buildings andstructures in terms of flying missiles.
Analysis of tornado impact on the dry spent fuel storage facility at the Zaporizhzhya NPP
revealed no adverse effects.
Other Extreme Weather Conditions (external fires; extreme high/low temperatures;
extreme wind; extreme snow; combination of external natural hazards).
New crucial external hazards or combinations of hazards additional to those incorporated
in NPP designs and analyzed in detail in NPP safety analysis reports have not been
revealed.
The robustness of the Zaporizhzhya NPP (and DSF), Khmelnitsky NPP, Rivne NPP, andSouth Ukraine NPP against the above-mentioned hazards was confirmed. No safety issues
were revealed.
Power Supply
Robustness of power supply is inherent in the plant designs. Each WWER-1000 and
WWER-440 power unit is designed to have three independent essential power supply trains,
each train containing a diesel generator and batteries. Each train of the emergency power
supply system in terms of its capacity and configuration of the connected loads can ensure
emergency reactor cooldown and long-term decay heat removal. The independency of three100

STATE NUCLEAR REGULATORY INSPECTORATE OF UKRAINENATIONAL REPORT ON STRESS TEST RESULTS

trains is ensured by their complete separation in terms of structures, processes, power
supply and control. In addition, each site has a common-unit reliable power supply system
containing two trains with independent diesel generators (DG) and batteries serving
important equipment of one or several units.
Hence, the total number of DGs installed at the NPP sites constitutes:
Zaporizhzhya NPP- 20 DGs, Khmelnitsky NPP– 8 DGs, Rivne NPP – 14 DGs, South
Ukraine NPP– 11 DGs.
All DGs at all NPPs are provided with a 7-day reserve of diesel fuel, while the time ofdesigned unattended operation of DGs in emergency mode is 250 hours.
In accidents involving off-site power supply, the design provides for transfer of WWER1000 and WWER-440 reactors into a safe state and long-term decay heat removal.
Additionally, all NPPs have several alternative possibilities for powering plant house loads
using the following schemes:− Zaporizhzhya NPP: from Zaporizhzhya Thermal Power Plant, from hydrogenerators of
the Dnipro Hydroelectric Plants–1, 2 and Kakhovka Hydroelectric Plant; from a diesel
generator of any Zaporizhzhya NPP unit; from any common-unit emergency diesel
generator; from 75 kV high-voltage lines. The construction of the 750 kV Zaporizhzhya
NPP-Kakhovka substation high-voltage line, which can also be used as an additional
power supply source, has been started.
− Khmelnitsky NPP: from a diesel generator of any Khmelnitsky NPP unit; from any
common-unit diesel generator; from 330 kV and 750 kV high-voltage lines.
− Rivne NPP: from a diesel generator of any Rivne NPP units (for units 1, 2 and 3, 4);from any common-unit diesel generator; from 330 kV and 750 kV high-voltage lines.
− South Ukraine NPP: from hydrogenerators of the Kremenchug Hydroelectric Plant andTashlyk Hydroelectric Pumped Storage Plant; from a diesel generator of unit 2 for unit 1(and vice versa); from any common-unit diesel generator.
Appropriate connection programs were developed; shift personnel were trained and are
re-trained on a routine basis.
In accidents involving loss of off-site power supply and failure of DGs, Ukrainian WWER1000 and WWER-440 reactors are provided with additional possibilities of power supply, andappropriate actions of the operating personnel are envisaged. Besides, additional measures
have been proposed as a result of stress tests, as discussed in Section 7.3.
Heat Removal
To ensure long-term decay heat removal, the following upgrades were implemented at
Ukrainian NPPs:− WWER-440 (Rivne-1,2). The new additional emergency SG feedwater system wascommissioned (2010). The system is independent, has air-cooled diesel-pumping
facilities and water inventory of 2×1000m3. Refilling of its tanks is possible. This system
is described in detail in Section 1.1.2 R of the Report.
− WWER-1000. Long-term makeup of emergency feedwater storage tanks and steam
generators in primary emergency cooldown in loss of house loads power using fire
hoses and mobile pumping units (fire engines) was ensured. This upgrade is describedin detail in Sections 1.1.2 Z, 1.1.2 Kh, 1.1.2 R, and 1.1.2 SU. Appropriate connection
programs were developed, changes were introduced into the operational andemergency procedures, personnel were trained and are re-trained on a routine basis.
Implementation of the above-mentioned measures for WWER-440 and WWER-1000
allows successful long-term decay heat removal in accidents, including loss of power supply.
Besides, additional measures have been proposed as a result of stress tests, as discussed in
Section 7.3.

101

STATE NUCLEAR REGULATORY INSPECTORATE OF UKRAINENATIONAL REPORT ON STRESS TEST RESULTSManagement of Beyond Design Basis Accidents
Symptom-based emergency procedures were implemented at NPP units. Actions of
personnel are aimed at prevention of accidents involving severe core damage.
Emergency plans have been introduced at NPPs and at the level of the operatingorganization.
An efficient accident management system was created, which includes the required
administrative and technical measures, means and resources to prevent and limit accident
consequences. External technical support is ensured in accident management at theoperator and national levels to mobilize additional human and technical resources.
7.2 Safety Issues
The safety assessment of WWER (V-213, V-320, V-302/338) designs to determine theirmain safety issues and establish a unique international approach to prioritize the safety
improvement measures was initiated by the IAEA in 1990. IAEA WWER safety “Issues
Books” were developed to establish and rank WWER NPP design and operational safetyissues.
The “Issues Books” provided the initial basis for developing the safety improvement
program for the Ukrainian NPPs. In addition, the comprehensive safety reassessment
studies that involved in-depth probabilistic and deterministic safety analyses for all operating
units suggested further technical basis for planning safety upgrades and including additional
measures into the safety improvement program.
An independent safety assessment of the Ukrainian NPPs was carried out in theframework of the common EC-IAEA-Ukraine project (Memorandum of Understanding on Cooperation in the Field of Energy between the European Union and Ukraine) in terms of thefollowing aspects:− Design safety assessment (ESRS);− Operational safety assessment (OSART);− Radioactive waste management assessment (RWRS);− Integrated regulatory review (IRRS).
In the framework of this project, 14 inspection missions at the four NPP units and the
IRRS mission were carried out. 62 experts from 23 countries and 32 IAEA representatives
participated in the missions.
Resulting from the project, the experts made a conclusion that the Ukrainian NPPs meetmost IAEA safety requirements and recommendations. For areas in which IAEA safety
requirements and recommendations were not completely met, it was confirmed that Ukraine
undertakes measures to eliminate these inconsistencies. No complete inconsistencies wererevealed.
In the framework of the design safety assessment, Ukrainian NPPs were examined forcompliance with the requirements of NS-R-1 “Safety of Nuclear Power Plants: Design”.
Following the assessment, it was confirmed that Ukrainian NPPs met completely 172 of 194
NS-R-1 requirements. Incomplete compliance was revealed for: equipment qualification,
consideration of severe accidents, NPP seismic resistance, completeness of probabilisticand deterministic safety analysis and post-accident monitoring.
The operational safety review mission confirmed that operational safety of the Ukrainian
NPPs was managed in a skilled and efficient manner.
Compliance with recommendations of “Issues Books”, comprehensive safety analysis andsafety reassessment of Ukrainian NPPs, as well as peer review results allowed determining
areas that require safety improvement and developing necessary safety improvement
measures.
The stress tests revealed no safety issues that were not identified previously. The stresstests demonstrated relevance of the safety improvement measures under theComprehensive (Integrated) safety Improvement Program.
102

STATE NUCLEAR REGULATORY INSPECTORATE OF UKRAINENATIONAL REPORT ON STRESS TEST RESULTS

According to stress test results, the main areas that require further improvement are as
follows:− increase NPP robustness against tornado (in terms of potential loss of essential
service water);− provide additional means for long-term decay heat removal from the core andspent fuel pools under station blackout and/or loss of ultimate heat sink (including
mobile equipment);− improve procedures for management of beyond-design-basis accidents in termsof mitigation of severe accident consequences;− conduct post-accident monitoring.
Stress tests have addressed in detail several possible safety improvement measures andconfirmed their efficiency:− main parameters of mobile facilities were determined (flow rate, pump head);− requirements for location of mobile equipment were established;− severe accident management strategies were analyzed: filtered pressure relief,hydrogen concentration control.
The following cliff edge effects were identified:− discharge time of batteries – loss of monitoring of reactor parameters and control
of steam dump devices for secondary systems;− water level reduction in the reactor pressure vessel below the level of main
coolant piping hot legs – makeup of secondary systems becomes ineffective due
to absence of natural circulation in main coolant piping loops;− start of irreversible heating of fuel claddings - the last possibility for the operator
to intervene, after which severe damage of reactor core begins;− reactor pressure vessel failure – strategies aimed at maintaining of thecontainment integrity have to be implemented;− containment failure - strategies aimed at decrease of fission product releases
have to be implemented.
The revealed cliff edge effects were considered in developing safety improvement
measures.
7.3

Potential Safety Improvements

In April 2011, based on analysis of the events that occurred at Fukushima-1, the SNRIU
obliged the operating organization to revise the scope and priorities of measures under theComprehensive Safety Improvement Program. The following measures have to beconsidered:− implementation of the hydrogen concentration monitoring system in containment
for beyond design basis accidents;− reliability increase of emergency power supply system under station blackout(mobile diesel generators);− additional seismic investigations of NPP sites and assurance of seismic
resistance of equipment, piping, buildings and structures important to safety;− detailed analysis of severe accidents and development of severe accident
management guides;− measures on severe accident management during ex-vessel stage;− provision of instrumentation before and after accidents;− modernization of NPP radiation monitoring systems;− implementation of a closed-circle television system for fire/explosion hazardousand non-serviced rooms.
Additionally, prior to stress tests, measures on forced emergency pressure relief from thecontainment at WWER-1000 units (containment venting) were already identified and put into
implementation.

103

STATE NUCLEAR REGULATORY INSPECTORATE OF UKRAINENATIONAL REPORT ON STRESS TEST RESULTS

Also a scope and deadlines for all measures had been revised and amended with due
consideration of their relevance in the light of the Fukushima-1 accident.
In addition to the above safety improvement measures, the following improvements havebeen identified from the stress test results:− assurance of operability of essential service water loads under loss of water inthe spray ponds as a result of tornado;− a series of measures aimed at assurance of long-term (up to 72 hours) residual
heat removal from the core and spent fuel pool under station blackout and/or lossof ultimate heat sink: makeup of secondary systems using mobile facilities;
 makeup of spent fuel pools;− emergency makeup of primary systems with boric water are under consideration(for compensation of potential loss of primary coolant));− development of severe accident management guides for spent fuel pools;− I&C upgrade to ensure the proper work under severe accident conditions.
The above measures have been additionally included into the Comprehensive Safety
Improvement Program. The Program has acquired the status of a national-level program, its
scope and funding sources have been determined on 7 December 2011.
In accordance with SNRIU Board Resolution No. 13 of 24-25 November 2011, themandatory condition for the operating organization to extend the lifetime of NPP units beyond
30 years will be the full implementation of the following measures:
1)
ensure robustness of equipment, piping, buildings and structures required for themain safety functions to seismic impacts not less than 0.1 g (0.12g for South Ukraine NPP);
2)
ensure performance of the main safety functions by NPP equipment in “harsh”
environments;
3)
implement containment venting systems at WWER-1000 plants;
4)
implement measures to ensure SG and spent fuel pool makeup (cooldown) underlong-term station blackout and/or loss of ultimate heat sink.
5)
introduce at NPP units:
severe accident management guides (relating to core and spent fuel pools);
symptom-based emergency operating procedures for shutdown states.
In addition to the stress tests and according to the “Action plan for targeted safetyassessment and further safety improvement of Ukrainian NPPs in the light of the events at
Fukushima-1” (approved by the SNRIU), targeted inspection of emergency preparedness
was conducted. Emergency exercises were performed at operating NPPs (25-26 May 2011
at Zaporizhzhya NPP; 29 September at Khmelnitsky NPP; 10-11 November at Rivne NPP;
24 November at South Ukraine NPP). The training scenarios were developed taking into
account the events at Fukushima-1 and included total station blackout with loss of ultimate
heat sink.

104

STATE NUCLEAR REGULATORY INSPECTORATE OF UKRAINENATIONAL REPORT ON STRESS TEST RESULTSPART 2. CHORNOBYL NPP

1 Ch GENERAL DATA ON THE CHORNOBYL NPP
1.1 Ch. Brief Description of the Site Characteristics
The Chornobyl NPP site is situated in the north of the Kyiv region on the right bank of thePripiat river. The ChNPP is located in the 30 km exclusion zone that was established after
the accident at power unit 4 in 1986.
The town of Chornobyl is located 15 km southeastward from the ChNPP, the town of
Slavutych is 60 km eastward and Kyiv is 110 km southward. The territory of the ChNPP isbordered by the Pripiat river from north and east, the lands and solid woods of the State
Forest Management Fund of Ukraine adjoin it from the south and west.
The following nuclear facilities are located on the ChNPP territory:− units 1, 2, and 3 (under decommissioning);− Interim Spent Nuclear Fuel Storage Facility (ISF-1).
The License holder is the State Specialized Enterprise Chornobyl NPP.
The decommissioning activities on units 1, 2, and 3 are based on the License issued by
the State Nuclear Regulatory Committee of Ukraine on 22 March 2002.
The ISF-1 is operated according to the License issued by the State Nuclear Regulatory
Committee of Ukraine on 25 June 2008.
Four nuclear facilities are located at the ChNPP site: three units with RBMK-1000 reactors
and ISF-1.
1.1.1 Ch

Main Characteristics of the Units

1.1.1.1.Ch Reactor Facilities
Units 1, 2, and 3 include RBMK-1000 reactor facilities.
Unit 1 was commissioned on 26 September 1977, shut down on 30 November 1996.
Unit 2 was commissioned on 21 December 1978, shut down on 11 October 1991.
Unit 3 was commissioned on 8 December 1981, shut down on 15 December 2000.
ChNPP units 1, 2 and 3 are under decommissioning.
105

STATE NUCLEAR REGULATORY INSPECTORATE OF UKRAINENATIONAL REPORT ON STRESS TEST RESULTS

Each power unit includes RBMK-1000 reactor (high-energy, channel-type, boiling-water
thermal reactor) with a thermal output of 3200 MW. Pressurized water was used as thecoolant and graphite as the moderator.
The power units contained one circuit, and the turbines received separated steam
generated in the reactor.
Each power unit includes two turbine generators of К–500–65/3000 type equipped with
TVV-500-2 electrical generators, 500 MW each.
The electricity generated by ChNPP Stage 1 was delivered through 110 kV and 330 kV
transmission lines. The electricity of generated by ChNPP Stage 2 was delivered through750 kV transmission line.
Spent fuel assemblies (SFA) have been unloaded from the reactor cores of units 1, 2 and
3.
There is no fresh nuclear fuel on the ChNPP site. There are 1365 SFAs in the unit 1
cooling pool and 1355 SFAs in the unit 2 cooling pool.
1.1.1.2.Ch Spent Fuel Storage Facilities
The ISF-1 is a wet storage facility intended for the receipt and storage of SFAs after
preliminary storage in spent fuel pools for at least 1.5 years or in reactors and for SFA
unloading from ISF-1 and subsequent transfer to the dry storage facility under construction(ISF-2).
The ISF-1 was commissioned in September 1986. The transfer of spent nuclear fuel fromthe spent fuel pools of units 1 and 2 and its placement into the spent fuel pool of ISF-1 began
in the same year.
ISF-1 is situated on the ChNPP north-westward to the main building of ChNPP Stage II.
The area occupied by the ISF-1 building, constructed from 1983 to 1986, is approximately
2500 m2.
ISF-1 is to be operated until the dry spent fuel storage facility (ISF-2) is commissioned,
taking into account time required for the transfer of SFAs from ISF-1 to ISF-2. It is planned tocommission ISF-2 in 2015. SFAs will be unloaded from ISF-1 during 9-9.5 years (~2025).
The spent fuel pools of ISF-1 contain 18564 SFAs. SFAs shall be cooled for more than 10
years.
1.1.2 Ch

Description of the Systems for Conduction of Main Safety Function

Power supply systems
The ChNPP site has power supply from the unified electricity grid of Ukraine throughORU-110/330/750 kV outdoor switchgears connected to the grid through two 750kV lines,
four 330kV lines and two 110kV lines. The 110/330kV outdoor switchgears are connected
through two 330/110kV autotransformers AT-1 and AT-2 and the 330/750kV outdoor
switchgears are connected through two 750/330kV autotransformers AT-3 and AT-4. Powerto the units, ISF-1 and other ChNPP loads is supplied by the 110/330 outdoor switchgear
using three lines: 110 kV line through 1TR, using two independent 330kV lines through 2 and3 TR. There is possibility to supply power to units 1, 2, 3 and ISF-1 by any transformer 1,2,3
TR through the 6kV backup busbar.
ISF-1 off-site power is supplied from two power sources: 6kV bus of 6RNA KRU-6kV
metal-clad switchgear of unit 3 (using IIDG-3 as automatic backup in case of loss power frombackup transformer 3TR) and 6kV but of 6RB KRU-6kV metal-clad switchgear of unit 3. ISF1 loads are powered from metal-clad transformer substation (KTPSN-0.5-6/0.4kV) with twotransformers 237Т and 238Т (TSZS-1000/6) through power distribution unit (RUSN-0.4kV)that includes two 0.4 kV buses 237N and 238N with automatic backup.

106

STATE NUCLEAR REGULATORY INSPECTORATE OF UKRAINENATIONAL REPORT ON STRESS TEST RESULTS

Spent fuel pools (SFP) of units and ISF-1. SFP makeup and level control
Design of the ChNPP units 1-3 spent fuel pools
There are SFA cooling pools (SFAP) and fuel channel cooling pools (FCP) to store fuelchannels and special items.
The SFAP is a reinforced concrete reservoir of 4.200х10.300m in the cross-section,
whose walls and bottom are lined with 12Х21Н5Т steel of 2 mm and 4 mm in thickness,
respectively. The Walls and bottom of cooling pools provide shielding for NPP personnel.
The capacity of two SFAPs is defined by complete unloading of the reactor core. SFAP
water volume at a rated level is 720m3.
Each SFAP has:
− a slotted slab consisting of 34 semi-rows of beams from the right side and 37
semi-rows of beams from the left side designed to suspend high-active items incanisters, 852 in each pool,− a transfer basket cell (characteristic load is 5,000 kg),
− a mechanism for loading of fuel assemblies into canisters from the refuelingmachine (characteristic load is 900 kg),
− emergency staircases.
SFAPs are also provided with piping to ensure:− heated water intake,− cooled water return,− water intake for treatment,− return of treated water,− water overflow if permissible levels are exceeded;− makeup and loading;− blow-off to the process venting system.
The SFAP slotted slab is formed by:− H-beams (VSt.3Sp 5 steel) embedded into the SFAP concrete wall. The beameffective length is 2,000 mm, the upper flange width is 120 mm, the bottom flange
width is 70 mm, the beam height is 200 mm, the distance between beams’ axes
constitutes 250x1 mm, and the central slot width is 200 mm,− rakes – 76x6 mm pipes (08Х18N10Т steel),− cover plates designed to prevent ingress of foreign items to the cooling pool andimprove steam removal to the process venting system.
The effective load on the slotted slab constitutes 400 kg/m2.
The slotted slab design provides for:− vertical installation of canisters,− fixation of canisters and their arrangement in the horizontal plane (canisters are
installed tightly on the console, the flange of the neighboring canister serves as
support),− fixation of the end canisters installed 12th in the row to prevent their displacement
towards a longitudinal slot and falling to SFAP with plates (h=10 mm) welded in
the upper part of the console end,
− installation of canisters into the lower support ring for cover plate removal.
All spent fuel assemblies loaded into the SFAP are stored in canisters according to thedesign layout at a pitch of 250х160 mm provided by the 250 mm distance between theslotted slab beams’ axes and 160 mm diameter of the canister flange.
The cooling circuit and the cooling pool water treatment circuit provide decay heatremoval from SFAs and water treatment. The following conditions are ensured:− water level in SFAP maintained within the operational limits (operational limit forunits 1, 2 is not lower than +19.2m and for unit 3 is not lower than +34.58m),
107

STATE NUCLEAR REGULATORY INSPECTORATE OF UKRAINENATIONAL REPORT ON STRESS TEST RESULTS− water temperature in SFAP is maintained within operational limits of 20-55°С.
There are systems for air venting above the cooling pools.
SFAP water quality is maintained by periodic actuation of the active water treatment
system SVO-2 or partial replacement of SFAP water with feedwater.
The unit 1 SFAP contains 1365 SFAs and unit 2 SFAP contains 1355 SFAs.
The ISF-1 contains 18564 SFAs. Spent nuclear fuel in ISF-1 is stored in the cooling poolconsisting of five compartments. ISF-1 cooling pool compartments are reinforced concrete
reservoirs, whose walls and bottom are lined with corrosion-resistant steel. The bottom liningis hard-faced to reinforced concrete embedded items. Walls lining is welded to reinforced
concrete plates installed earlier. The walls and bottom of the cooling pool compartments
provide shielding for ISF-1 personnel. Cooling pool compartments have a slotted slab, which
is a console-type support without rakes used for suspension of the fuel assemblies incanisters. Fuel assemblies are stored in the cooling pool compartments in canisters filledwith water at a pitch of 230x110 mm. The slotted slab is closed from above with hinged metal
cover plates designed to prevent ingress of foreign items to the cooling pool and improvesteam removal to the process venting system.
The cooling pool compartment up to elevation 11.35 m is made of М300 and В-8 hydraulicconcrete. Walls along the numerical axes are 125 cm thick (internal) and 150 cm thick(external). Standard М300 concrete is used above elevation 11.35 m. The walls and bottomof ISF-1 are made of 12Х21N5Т corrosion-resistant steel to ensure safety of the storage
facility operation: walls are 4 mm thick and bottom 8 mm thick. Grooves ensuring moisturecollection from under the lining are made on a concrete bed to prevent potential leakages.
The grooves end with pipes 76 mm in diameter passing to the room for cooling pool leakagecollection and monitoring.
The transfer basket storage compartment (TBSC) of ISF-1 is located in the section forreceipt and reloading of a cask car. It is used for the receipt and storage of transfer baskets,reloading of spent fuel assemblies from a transfer basket to the canisters and from thecanisters to a transfer basket, as well as for temporary storage (placement) of spent fuelassemblies at places of canister accumulation.
A trench is located in the section for cask car receipt and reloading and is used for storage(placement) of spent fuel assemblies and to ensure transfer of canisters with SFAs to/fromthe compartments of the ISF-1 cooling pool.
The TBSC and trench are reinforced concrete reservoirs whose walls and bottom are
lined with corrosion-resistant steel. The wall lining is 4mm thick and bottom lining is 8 mm
thick. The walls and bottom of the TBSC and trench provide shielding for ISF-1 personnel.
The TBSC bottom is covered with special plate-steel covering to serve as a damper toreduce the probability of severe damage to TBSC structures that can be caused by falling ofseparate canisters or a basket with a fuel assembly during handling.
The cooling pool compartments, trench and TBSC are filled with feedwater. The rated
level is +10.50 m. The rated level in the compartments of the cooling pool, trench and TBSC
is ensured by operation of the automatic level control circuit. Any compartment can beisolated using hydraulic locks (sluice).
Cooling pool makeup for ISF-1 is ensured through two lines: operating makeup of at least
48 m3/h and additional makeup of at least 67 m3/h. The emergency makeup of at least
115m3/h is ensured through equipment redundancy.
1.2 Ch. Significant Differences between Units
Units 1 and 2 are located in one main building and have common auxiliary systems.
Before the 1986 accident, units 3 and 4 were a single structure; after the accident, unit 3
was separated from the destroyed unit 4 with a newly constructed reinforced-concrete wall.

108

STATE NUCLEAR REGULATORY INSPECTORATE OF UKRAINENATIONAL REPORT ON STRESS TEST RESULTS

The Chornobyl NPP was constructed in stages using a “two-boiler single-turbine” layout
for two power units. ChNPP Stage I includes units 1 and 2 representing the design of first
generation. Unit 3 represents the design of second generation and is a part of Stage II. A
separate main building is envisaged for each Stage, where the main and auxiliary equipment
is located. Besides the main buildings, auxiliary buildings and structures are located on thesite to ensure NPP operation.
The main differences between the designs of first and second generations basically
included distinctions between the accident confinement systems, configuration of emergency
systems, reactor core and reactivity control systems, and layout of power units.
Fresh nuclear fuel has been fully removed from the Chornobyl NPP territory.
Spent nuclear fuel has been fully unloaded from unit 3. Spent nuclear fuel safe storage,
preparation for spent nuclear fuel unloading from units 1 and 2 and decommissioning ofsystems and components that are not used are the main activities ongoing at units 1, 2, 3.
1.3 Ch. Use of PSA as Part of the Safety Assessment
The analysis was carried out by postulation and analytical modeling of emergencies under
extreme hazards. The worst scenarios and their combinations were analyzed in the report.
Documents on safety assessment of the nuclear facilities and other on-site facilities werecollected and analyzed; the worst probable threats to safety and major risks were identified;and safety measures supported organizationally or technically were determined. The reportanalyzes the ChNPP procedures and ChNPP personnel capabilities to mitigate emergencies
including, in particular, a scenario of complete loss of power and heat removal from spent
nuclear fuel and also beyond design basis accidents (BDBA) involving damage of nuclear
facility barriers.

2 Ch EARTHQUAKES
2.1 Сh Design Basis
2.1.1 Ch Earthquake against Which the Plants are Designed
The maximum possible earthquake intensity is estimated as 4.5±0.5, with the depth ofpossible earthquake sources of 5÷25 km. The minimum distance from the ChNPP site to theeastern part of the Teterev fault is 16 km. In designing the plant, the design earthquake6 (DE)was considered to be 5 on the Richter scale, and the maximum calculated earthquake7(MCE) to be 6 on the Richter scale.
2.1.2 Ch Provisions to Protect the Plants against the Design Basis Earthquake
According to the design, old dusty sands and loamy sands were removed from under thefoundation of the main buildings and replaced with fine and medium-size alluvial sands,
rolled to the condition close to natural state (у=1.7 kgf/cm).
Long-term observations of turbogenerators 1-6 and 7-8 have shown that serious vibrationloads on the foundation sands have not led to manifestation of thixotropic and running
properties in the sand mass and have not caused changes in stability of foundations.
Carpathian earthquakes in 1977-1986, that caused shocks with intensity of up to 5 points
in the area of ChNPP location, had no influence on soils of foundations of main buildings andstructures of units 1, 2 and 3.
Laboratory studies of dynamic stability of water-saturated sandy soils of foundations of theobjects, carried out in 1993, indicate impossibility of their liquefaction in case of seismic
actions of 7-point earthquake on the MSK-64 scale.
General technical state of buildings and structures of units 1, 2, 3 and ISF-1 issatisfactory. In course of their operation, the following is performed:
6

DE corresponds to Seismic Level 1 (SL-1) in IAEA practice and Operating Basis Earthquake (OBE) in USA practice7

MCE corresponds to Seismic Level 2 (SL-2) in IAEA practice and Safe Shutdown Earthquake (SSE) in USA practice109

STATE NUCLEAR REGULATORY INSPECTORATE OF UKRAINENATIONAL REPORT ON STRESS TEST RESULTS

1.

Year-round operation of plenum and exhaust ventilation, as well as operation of heating
during winter season, is ensured.
2.
Regular control of state of water-supply communications and, if necessary, their prompt
repair are carried out.
3.
Maintenance, minor and major repairs, and engineering inspections are performed
according to regulatory requirements.
4.
Building operation is carried out in accordance with the following documents:− "Technical Operation of Power Plants and Networks. Rules GKD 34.20.507-2003".
− "Provisions on Engineering Supervision of ChNPP Industrial Buildings and Structures,
81P-S".
2.1.3 Ch

Compliance of the Plant with Its Current Licensing Basis

The documents “Basic Regulatory Requirements and Estimated Characteristics ofEarthquakes for the Chornobyl NPP Site” and “Basic Regulatory Requirements andEstimated Characteristics of Tornados for the Chornobyl NPP Site” were developed andapproved in 2005. Studies conducted for units 1 and 2 and ISF-1 in 2005-2008 confirm thestructural stability of the power units and cooling pools under earthquakes up to MCE.
2.2 СhEvaluation of Safety Margins

2.2.1 Ch

Range of Earthquake Leading to Severe Fuel Damage

It was postulated during stress tests that the earthquake with intensity of more than 6 on
the Richter scale (exceeding MCE) will cause a beyond design basis accident involving
nuclear fuel damage, whose radiological consequences will require personnel evacuation.
Nuclear fuel damage means loss of fuel cladding integrity and release of fission products. In
terms of nuclear fuel damage, the worst scenario involving loss of heat removal from spent
nuclear fuel (loss of ultimate heat sink and loss of water in the cooling pools) and loss of
power was considered. This situation is postulated as deterministic regardless of its
probability.
2.2.2 Ch

Range of Earthquake Leading to Loss of Containment Integrity

During the period from September 2004 to May 2005, the Geophysics Institute of the
National Academy of Sciences of Ukraine recorded earthquakes at the Chornobyl NPP site.
The estimated earthquake characteristics for the Chornobyl NPP site were based on
instrumental surveys and analytical studies.
The estimated characteristics of seismic impacts at the Chornobyl NPP site are presented
in the document “Basic Regulatory Requirements and Estimated Characteristics ofEarthquakes for the Chornobyl NPP site”, approved by letter No. 3/19-19 dated 8 July 2005
by the State Construction Committee of Ukraine.
Characteristics (accelerograms, ground response spectra, etc.) are established in therange of seismic vibrations 0.033÷100 Hz. The MCE intensity is 6 according to the MSK-64
scale and the DE intensity is 5. The peak ground acceleration for MCE (DE) is 0.1 (0.05) g.
The list of extreme hazards considered during stress tests of the ChNPP nuclear facilities
is sufficient, their characteristics at the Chornobyl NPP site are established in compliancewith Ukrainian regulatory requirements and studies were completed correctly and in
adequate scope. The scope of characteristics is sufficient. Upon the results of ChNPP stresstests, additional studies were proposed to evaluate safety margins during extreme events.
2.2.3 Ch Earthquake Exceeding the Design Basis Earthquake for the Plants andConsequent Flooding Exceeding Design Basis Flood
The cooling pond is located near the ChNPP site. A break of weakest dam area cannot becompletely excluded in case of an earthquake with intensity of 6.

110

STATE NUCLEAR REGULATORY INSPECTORATE OF UKRAINENATIONAL REPORT ON STRESS TEST RESULTS

ChNPP site levels are not less than 113.7m. The normal design level of the cooling pond
is 111.3m. The difference between levels permits a conclusion that there is no risk of ChNPP
site flooding, but dam failure will affect radiological situation.
The water reservoir discharge will minimize the risk of dam failure due to caving and water
head. At present, feasibility study for cooling pond decommissioning is under development.
2.2.4 Ch Measures Which Can Be Envisaged to Increase Robustness of the
Plants against Earthquakes
According to the License issued by State Nuclear Regulatory Committee of Ukraine on 25
June 2008, the ChNPP implements measures envisaged in the “ISF-1 Safety Improvement
Plan”. A number of measures to improve ISF-1 safety were implemented in 2008÷2011,
namely:− structures were reinforced,− additional line for cooling pool makeup was arranged,− system for collection, treatment and return of water to the cooling pools in case ofloss of their integrity loss was implemented.
Upon the results of stress tests, the Chornobyl NPP planned the following for category 1
buildings and structures at the ChNPP:− studies of safety margins for structures in case of earthquakes exceeding MCE,
− studies of safety margins and failure probabilities for cooling pool lining (first of all
ISF-1) in case of earthquakes exceeding MCE.
In addition, the ChNPP has plans to evaluate seismic resistance of equipment and service
lines (e.g., cooling and water level control systems for cooling pools) according to regulatory
requirements and using earthquake characteristics obtained in 2005 and then, based on the
results, to implement measures to improve the seismic resistance of equipment and service
lines.

3 Ch FLOODING
3.1 Сh Design Basis
The extreme water level was determined as 111.3 m based on analyses using results oflong-term hydrological studies.
3.2 Сh Evaluation of Safety Margins
External flooding does not create a direct danger for the ChNPP nuclear facilities because
the levels of the ChNPP site (113.7÷114.0 m) are significantly higher than the extreme highwater level (111.3 m). Therefore, this extreme impact has not been considered in the stresstests.

4 Ch EXTREME WEATHER CONDITIONS
4.1 Ch Design basis
Tornado
The characteristics are established upon results of analytical studies performed in 2002
using meteorological data for the ChNPP location region collected during many years. The
maximum tornado is F 3.0 class on the Fujita-Pearson scale, design tornado is F 1.5. The
pressure drop between the tornado vortex center and periphery for F 3.0 (F 1.5) is 8.1 (3.1)
kPa, the maximum vortex rotation speed is 81 (50) m/sec, and the tornado width is 290 (50)m.
Extreme Wind
The characteristics are established by extrapolation (according to Eurocode Standards) of
the standard wind characteristics defined in State Construction Standards DBN В. 1.2-2:2006
for the ChNPP location region. The load for the height from the ground surface varying from
5 to 110 m is 0.656 to 1.92 kPa.
111

STATE NUCLEAR REGULATORY INSPECTORATE OF UKRAINENATIONAL REPORT ON STRESS TEST RESULTS

Extreme Air Temperature
The characteristics are established on the basis of State Construction Standards DBN В.
1.2-2:2006 and PiN AE-5.6 for the ChNPP location region and are - 43ºС and +45ºС.
Extreme Snow
The characteristics are established upon results of analytical studies using meteorological
data for the ChNPP location region collected during many years. The load constitutes 2.1
kPa.
Extreme Rainfalls
The characteristics are established on the basis of regulatory requirements for the ChNPP
location region. The maximum value is 72 mm for 20 minutes and 190 mm per day.
Extreme natural events are ranged in the following way:
1) earthquake and tornado are the most hazardous for the ChNPP nuclear facilities,2) extreme wind, snow, rainfall and air temperature are significantly less hazardous
because:− impacts of extreme wind, snow and rainfalls are much less intensive than tornado
impact;− structures of nuclear facilities have slow thermal response,− temperature regime in buildings is maintained, snow is removed, rainfall drainage
system is functioning, etc.
The list of extreme hazards considered during stress tests of the ChNPP nuclear facilities
is sufficient, their characteristics at the Chornobyl NPP site are established in compliancewith Ukrainian regulatory requirements and studies were completed correctly and in
adequate scope. The scope of characteristics is sufficient.
Conclusions made on ranking of external hazards by their danger for nuclear facilities are
justified.
4.2 Ch Evaluation of Safety Margins
4.2.1 Ch

Estimation of Safety Margin against Extreme Weather Conditions

The extreme hazards for the ChNPP nuclear facilities such as extreme wind, snow,
temperature, rainfall, flooding and external fires are less hazardous than an earthquake or
tornado. Therefore, the operating organization considers earthquakes and tornadoes as
initial events causing loss of safety functions (loss of power and heat removal) in thistargeted safety assessment.
4.2.2 Ch Measures Which Can Be Envisaged to Increase Robustness of theUnits against Extreme Weather Conditions
According to regulatory requirements, category 1 structures of the ChNPP nuclear
facilities shall be resistant to MCE, F 1.5 tornado, extreme wind, snow and temperature. The
surveys and strength calculations of structures were performed, including those for extreme
impacts, and measures for reinforcement/restoration of some structures of the nuclear
facilities were implemented. As regards resistance of the walls and bottom of cooling pools(ISF-1 and units 1, 2, 3), this conclusion concerns reinforced-concrete structures only, but
not the stainless-steel lining of cooling pool walls and bottom. The resistance of lining (inparticular, welds) was not subjected to calculations. Some measures were implemented at
ISF-1 in case of lining failure. They included, in particular, introduction of an additional
system for cooling water collection, treatment and return.
The ChNPP has planned to additionally analyze the resistance of ChNPP category 1
structures and potential structural failures under F 3.0 tornado.
The ChNPP has planned to evaluate the resistance of outdoor service lines to extreme
impacts (e.g., lines of systems for water supply to the cooling pools, storm sewage) and, if
necessary, implement appropriate measures.
112

STATE NUCLEAR REGULATORY INSPECTORATE OF UKRAINENATIONAL REPORT ON STRESS TEST RESULTS

5 Ch LOSS OF ELECTRICAL POWER AND LOSS OF ULTIMATE HEAT SINK
5.1 Сh Loss of Electrical Power5.1.1 Ch Loss of Off-site PowerThe ChNPP site electrical power supply system is sufficiently reliable. Station blackout
may occur in case of full failure of the electrical grid of Ukraine and loss of ChNPP
110/330/750 outdoor switchyard connections with the Central and Southwestern powersystems and Kiev power center.
The operating organization has reliable operating procedures for restoration of off-site
electrical power. The operating personnel are regularly trained according to theseprocedures. The emergency diesel generators (EDG) of ChNPP Stage II can supply power toall loads needed to maintain levels in the cooling pools of power units and ISF-1,
temperature of SFA storage, operation of ventilation systems and radiation monitoring of the
ChNPP. DGs can be started up within 15 seconds.
As of 30 June 2011, there are 75.6 tons of diesel fuel ensuring autonomous operation of
two DGs at full load during 3.5 days, or operation of one DG during 7 days ensuring power
supply to makeup systems of SFA storage locations. This time is sufficient to arrange
uninterrupted supply of diesel fuel.
Based on results of emergency training conducted with emergency personnel (Emergency
Training-50Е “Full Loss of Power Supply to ChNPP Auxiliary Systems”), time required torestore power supply of units 1 and 2 from EDG-2 is equal to 42 minutes. This time is similar
to the design time for unloading of one unit cooling pool in DN Ø100 pipeline rupture, which,taking into account the accepted conservative approach, confirms the sufficient time margin
restoration for safety functions.
5.1.2 Ch Loss of Off-site Power and Loss of the Ordinary Backup AC Power
SourceUnit 3 batteries ensure operation of the radiological monitoring control board in terms of
DC loads, emergency lighting, 0.4 and 6 kV control bus for circuit breakers. Therefore, basedon the load, operation of the batteries is ensured for 22 hours (group 1) and 33 hours (group2).
5.1.3 Ch Loss of Off-site Power and Loss of the Ordinary Backup AC Power
Sources, and Loss of Permanently Installed Diverse Backup AC Power Sources
Power loss scenarios, including loss of off-site power, were considered in the stress tests.
Loss of pool water cooling and hydrogen removal functions are the most critical scenarios
under loss of power. The following has been defined based on ChNPP stress tests results:− in case of loss of pool water cooling function, SFA temperature will increase but
will not exceed 70°С (under water presence in the cooling pool), and thus it will
not cause an accident,− if hydrogen removal function is lost, hydrogen concentration in the cooling pool
will increase and achieve the lower explosive limit (4%) during 10 days according
to the conservative calculations. Experimental studies at ISF-1 demonstrated thathydrogen concentration stabilizes at 0.2%.
If neither off-site power nor power from EDGs can be ensured, the operating organization
has a mobile DG station (MDGS) and corresponding tested procedure for its connection andpower supply to ISF-1 loads. Considering all organizational and technical measures, timerequired to connect MDGS does not exceed 8 hours. Based on the results of tests conducted
on 7 November 2011, it has been established that in case of ISF-1 blackout the existing
MDGS can ensure:− lighting of all ISF-1 rooms,
113

STATE NUCLEAR REGULATORY INSPECTORATE OF UKRAINENATIONAL REPORT ON STRESS TEST RESULTS

−
−
−
−

operability of ISF-1 radiation monitoring system,
operability of ISF-1 alarm and process monitoring systems,
operability of ISF-1 SFP automatic makeup system,
collection and release of leakages from under the lining of ISF-1 cooling pools,
TBSC and trench by pumps of ISF-1 active drain treatment system.

5.1.4 Ch Conclusion on the Adequacy of Protection against Loss of ElectricalPower
Analysis of power loss performed in the framework ChNPP stress tests, conclusions andmeasures implemented based on the stress tests results (MDGS arrangement) are sufficientand reasonable.
Loss of power to units 1, 2, 3 and ISF-1 does not lead to accidents with nuclear fueldamage. The nuclear facility design envisages electrical power redundancy; layout and interunit connections ensure high reliability of nuclear facility auxiliary systems. At the same time,spent fuel design ensures hydrogen safety and there is a sufficient time margin forrestoration of safety functions lost during an accident.
The actual time for restoration of power on-site is as follows:− unit 3 and ISF-1 ≤15 sec (time of DG-2 startup),− units 1 and 2 ~40 min (based results of emergency training performed withpersonnel (Emergency Training-50Е “Full Loss of Power Supply to ChNPP
Auxiliary Systems”), time required to restore power supply of units 1 and 2 from
DG-2 is 42 min),− time of power supply restoration from the electrical grid is the time of restorationof normal electrical power supply of auxiliary systems with diesel generator
shutdown and will constitute from 1.5 to 2 hours in case electrical grid integrity is
not lost.
5.1.5 Ch Measures Which Can Be Envisaged to Increase Robustness of the
Plants in Case of Loss of Electrical PowerAt present, technical measures to connect MDGPU to the ISF-1 power supply system
without changing of actual power supply diagram are implemented. Time required forconnection and startup of MDGPU has been established as ≤ 8 hours considering
implementation of organizational and technical measures based on the results of practicaltests of power supply and time needed for that.
5.2 Сh Loss of the Decay Heat Removal Capability/Ultimate Heat Sink
5.2.1 Ch Design Provisions to Prevent the Loss of the Primary Ultimate Heat
Sink, Such as Alternative Inlets for Sea Water or Systems to Protect Main Water
Inlet from Blocking
Spent nuclear fuel temperature storage mode.
The typical time values to achieve the following parameters were obtained in the result of
calculations performed:− fuel cladding temperature will reach 48°С during 2 months in case of pump
failure, and it will be limiting value (stationary state at cooling pool walls andenvironment temperature of 20°С),− fuel cladding temperature can reach maximum 64°С in the cooling pool central
part under the worst environmental conditions when cooling pool walls heat up to45°С, and environmental temperature is equal to 45°С,− conditions of fuel cladding heating to higher temperatures during pump failure
and water presence in the cooling pool were not identified (100°С is notreached);− if there is no water in the cooling pool, fuel cladding temperature (natural air
cooling) will exceed 300°С in 57 days in the cooling pool central part;114

STATE NUCLEAR REGULATORY INSPECTORATE OF UKRAINENATIONAL REPORT ON STRESS TEST RESULTS− fuel cladding temperature will exceed 300°С in the entire cooling pool inapproximately 1-2 weeks depending on the environment temperature and cooing
pool wall temperature.
Possibility to restore operability of the cooling pool water supply systems for the period
significantly less than 50 days was analyzed and justified during stress tests.
The conclusions are correct for the conditions of MCE impacts when stability of thebuildings with cooling pools containing spent fuel is ensured.
5.2.2 Ch Loss of the Primary Ultimate Heat Sink (e.g., Loss of Access to Cooling
Water from the River, Lake or Sea, or Loss of the Main Cooling Tower)
Time required for the restoration of the heat removal from spent fuel is conservative, notless than time required for the restoration of power supply to systems ensuring spent fuelmakeup and constitutes ≤8 hours considering the time required for implementation oforganizational measures and operating procedures.
5.2.3 Ch

Loss of the Primary Ultimate Heat Sink and the Alternate Heat Sink

Maintenance of the level in cooling pools with spent fuel is sufficient to ensure heatremoval. Therefore, the operating organization has paid special attention to issues of levelstabilization during stress tests. Technical measures were arranged and personnel weretrained on cooling pool level stabilization by returning of pool leakages to the supply line
without their purification for ISF-1. Actual time to ensure level stabilization is 30 minutes.
5.2.4 Ch Conclusion on the Adequacy of Protection against Loss of Ultimate
Heat Sink
Nuclear safety of spent fuel storage in ISF-1 cooling pool compartments under normal
operation conditions, operational events and DBA is ensured. ISF-1 nuclear safety is
substantiated taking into account the burnup. Loss of ultimate heat sink does not lead to fueldamage taking into account level stabilization measures, which were proven at ISF-1.
5.2.5 Ch Measures Which Can Be Envisaged to Increase Robustness of the
Plants in Case of Loss of Ultimate Heat Sink
The measures to ensure ChNPP equipment with cooling pool makeup mobile means havebeen proposed, and level stabilization measures have been proven in practice.
5.3 Сh Loss of the Primary Ultimate Heat Sink, Combined with Station Blackout
The scenario of loss of heat removal combined with loss of power and adequate
emergency measures do not differ significantly from specific scenarios of loss of heatremoval from SFAs or electrical power loss. The operating organization sets electrical power
supply to the systems supporting makeup as a priority considering fuel storage thermal
conditions. This will prevent fuel damage considering the pool level stabilization measures.
5.3.1 Ch Time of Autonomy of the Site before Loss of Normal Cooling Conditionof the Reactor Core and Spent Fuel Pool (e.g., Start of Water Loss from thePrimary Circuit)
Time of the site autonomy in terms of the characteristics of ChNPP spent fuel in case ofcooling pool lining integrity is more than 2 months.
5.3.2 Ch External Actions Foreseen to Prevent Fuel Degradation
Water supply from mobile sources (fire trucks) is envisaged to prevent fuel damage underlong-term loss of water cooling. This measure is sufficient for the actual spent fuelcharacteristics.
5.3.3 Ch Measures Which Can Be Envisaged to Increase Robustness of the
Plants in Case of Loss of Primary Ultimate Heat Sink, Combined with Station
Blackout
Units 1, 2, 3 and ISF-1 blackout does not lead to accidents with fuel damage. Nuclear
facility design envisages redundancy of electrical power supply; layout and inter-unit
115

STATE NUCLEAR REGULATORY INSPECTORATE OF UKRAINENATIONAL REPORT ON STRESS TEST RESULTS

connections ensure high reliability of nuclear facility auxiliary systems. At the same time,
characteristics of stored spent fuel are such that hydrogen safety is ensured and there is asufficient time margin for restoration of safety functions lost during an accident. According to
the conservative approach, the time of ChNPP nuclear facility power supply restoration (incase power grid is not lost) does not exceed 2 hours.

6 Ch SEVERE ACCIDENT MANAGEMENT
6.1 Ch Organization and Arrangements of the Licensee to Manage Accidents
6.1.1 Ch Organization of the Licensee to Manage the Accident
Attribution of emergency states at the ChNPP facilities to one of the establishedcategories shall be performed on the basis of quantitative and qualitative qualification
features.
The plant shift supervisor (PSS) must immediately notify the ChNPP personnel,
responsible persons, regulatory authorities, external entities about accident
origination/hazard.
The ChNPP emergency structures include the following:− Site Emergency Work Manager (SEWM);− coordination and management body – SEWM Headquarters;− permanent management body;− ChNPP emergency teams and groups.
The ChNPP emergency documents, emergency measures and actions ensurecomprehensive approach accounting all the facilities located on the site. The possibility toensure heat and power supply of the emergency facility from systems and equipment ofoperating facilities is envisaged.
Common systems for the nuclear facilities (NF) are the following:− systems ensuring water inventory;− integrated service water supply system;− DG-2.
All the specified systems (except for DG-2) are redundant as regards performance of mainfunctions at the NF upon availability of power supply.
Availability of backup busbars (RShA-1,2,3, RShB-1,2,3), sectioned with switches andreserve transformers (1,2,3TR), at each unit allows power supply all the NF from one of thesources: diesel power station, 1,2,3TR and site substation. In case of loss of external power
supply and damage of RShA-3, RShB-3 or RShA-2, RShB-2, there is no possibility to supply
units 1, 2 from the diesel power station and site substation – only unit 3 and ISF-1 will stayunder voltage. In case of damage of RShA-3, RShB-3, there is no possibility to power unit 3
and ISF-1 from 1,2,3TR and site substation.
6.1.2 Ch Possibility to Use Existing Equipment
On 7 November 2011, the ChNPP conducted tests for connection of the mobile diesel
generator station (MDGS) to ISF-1 responsible consumers. In accordance with the obtained
results:− MDGS delivery time – depending on access ways condition, 0.5÷7 hours;− MDGS connection time ~ 40÷60 min.
Procedures for connection of alternative sources for cooling pool makeup are underdevelopment. The results and experience of full-scale exercises and training according to thestress test scenario conducted on 15 September 2011 (under the program “Multiple failuresof regular systems and equipment in conditions of extreme natural phenomena”) during
which recovery of ISF-1 makeup was ensured during 30 minutes by forwarding ISF-1 cooling
116

STATE NUCLEAR REGULATORY INSPECTORATE OF UKRAINENATIONAL REPORT ON STRESS TEST RESULTS

pool leakages to SFP sections without treatment (“small circle”) have been taken as thebasis of these procedures.
At the ChNPP 75.6 tons of diesel fuel is available to ensure autonomous operation of two
DGs during 3.5 days at full load, or operation of one DG during not less than 7 days. This
time is sufficient to arrange uninterrupted diesel fuel supply.
Water inventory for ISF-1 cooling pool makeup is ensured by:− pure condensate inventory in amount not less than 1500 m3;− water inventory in amount not less than 500 m3.
The total reserve of pure condensate is 13500 m3.
Resupply of water inventory is performed from different design systems in required
amount. Use of mobile water supply equipment is envisaged in case of failures of design
systems.
6.1.3 Ch Evaluation of Factors That May Impede Accident Management andRespective Contingencies
Damages of the infrastructure around the ChNPP (roads, bridges over the Pripiat river)complicating access to the site are possible during a high intensity earthquake. Restorationof the infrastructure and access ways will be performed in the framework of the measures of
the accident liquidation, for implementation of which at the ChNPP there is sufficient time
margin (several weeks) in accordance with spent fuel characteristics and state. The ChNPP
NF envisages development of measures for arrangement of prompt delivery of emergency
teams from Slavutych by alternative routes in case of failure of Slavutych – ChNPP railway
because of an earthquake.
In case of strong flood the access to the site will be limited; however, the flood does not
result in an accident on the site.
6.1.4 Ch Conclusions on the Adequacy of Organizational Issues for AccidentManagement
One of the main factors impacting emergency management is loss of power supply anddamage of pipelines ensuring the cooling pool level and spent fuel cooling. There is sufficient
time margin (weeks) for taking compensating measures to ensure heat removal from spent
nuclear fuel.
6.1.5 Ch Measures That Can Be Envisaged to Enhance Accident Management
Capabilities
The ChNPP main organizational structures shall perform all the activities on emergency
planning, assurance of emergency preparedness and response in case of accidents andemergencies at the ChNPP. In its actions the operator shall follow “The ChNPP Plan for
Response to Accidents and Emergencies” intended to decrease the level of radiation impact
on personnel, population and environment in case of accidents or emergencies at the
ChNPP facilities.
The ChNPP emergency organizational structures include the following:− ChNPP Site Emergency Work Manager (SEWM);− Coordination and management body – SEWM Headquarters or the ChNPP
Facility Commission for the issues of emergencies;− Permanent management body – Emergency Preparedness and Response
Department;− ChNPP emergency teams and groups.
For accident liquidation the operator has emergency units amounting to 293 persons. The
ChNPP emergency units include general and special purpose emergency groups and teams.
General purpose emergency groups and teams:− Engineering support group;− Group for laboratory analysis of radiation situation;
117

STATE NUCLEAR REGULATORY INSPECTORATE OF UKRAINENATIONAL REPORT ON STRESS TEST RESULTS

−
−
−
−
−
−
−
−
−
−
−

Individual exposure dose account group;
Dosimetry survey group;
Shelter dosimetry survey group;
Chemical survey group;
Logistics group;Group of information support and communication with external entities;
Communication team;Transport and work mechanization team;
Personnel sanitary treatment team;Protective structures maintenance team;Physical protection assurance group.

Special purpose emergency groups and teams:− Team for localization and liquidation of accidents related with spent nuclear fuel;− Team for localization and liquidation of accidents on electric equipment;− Team for instrumentation damage liquidation;− Team for liquidation of accidents on heat underground communications andwater supply networks;− Team for localization of accidents on heat mechanical equipment;− Team for localization of accidents at the Shelter heat mechanical equipment;− Team for localization and liquidation of accidents on hydrotechnical structures;− Team for emergencies during transportation of radioactive materials.
The following formations, sub-divisions and military units can be involved into emergency
response actions to support the ChNPP emergency personnel as well as to perform special
tasks at the ChNPP facility sites, in sanitary protective zone and observation zone inaccordance with the established procedure:− Military Unit 3041 shall perform tasks of physical protection of the ChNPP, guard
the area exposed to contamination, control access to the site within radiation
contamination zones, ensure protection of material assets at the NPP territory
and at external facilities;− 1-SFPU (State Fire Protection Unit at the ChNPP) shall extinguish fires arising at
the ChNPP facilities in accordance with the “Operating plan of fire extinguishingat the Chornobyl NPP Main Building”, “Operating plan of fire extinguishing at the
ChNPP Shelter”, “Operating plan of fire extinguishing at the ChNPP”, and provide
emergency rescue services by means of emergency teams and groups;− Specialized medical sanitary units No. 5 (Slavutych) and No. 16 (Chornobyl) shallprovide first medical aid, qualified and specialized medical aid to victims, arrange
evacuation of victims for hospitalization in medical institutions;− Personnel and resources of the Ministry for Emergencies, Administration of
Exclusion Zone and Zone of Obligatory (Mandatory) Resettlement, Ministry ofFuel and Energy, Ministry of Defense, Ministry of Internal Affairs, Security Serviceof Ukraine, Ministry of Health.
Units of external entities arriving to the Chornobyl NPP to help in localization of theaccidents and localization of its consequences shall be subordinated to SEWM and follow its
directions.
Under an accident at the ChNPP facilities and during its liquidation the management ofemergency activities on site shall interface with the State nuclear regulatory authority at twolevels:− at facility level – with the State Nuclear Safety Inspectorate at the ChNPP;− at state level – with the Information and Crisis Center of the State Nuclear
Regulatory Inspectorate of Ukraine.
Emergency response means
MCR (main control room), CCR (central control room)
118

STATE NUCLEAR REGULATORY INSPECTORATE OF UKRAINENATIONAL REPORT ON STRESS TEST RESULTS− Monitoring of the cooling pool and control of safety-related systems during routine
operation and accidents shall be performed from the MCRs of Chornobyl NPP
units. Means to ensure accessibility and habitability of the MCR for operation
under accident conditions are envisaged in the design.
− Monitoring and control of the ChNPP power grid and reserve bus ducts RShA,
RShB for the possibility to back-up power supply of consumers of units in case ofstation blackout shall be performed from the CCR. Control of fire extinguishingand fire alarm systems of the units. Coordination of the personnel actions during
accident management until activation of the Crisis Center is ensured.
− The Chornobyl NPP Internal Crisis Center.
The Internal Crisis Center is located within the protective structure No. 1 and is a center
for management of emergency actions at industrial site of the Chornobyl NPP facilities and in
the controlled area. From the Crisis Center, the SEWM and its Headquarters shall perform
management of emergency teams and groups on monitoring and forecasting radiation
situation, actions for personnel protection, communication with crisis centers of ministries
and departments, emergency structures of local authorities and other entities performing
emergency activities in the area of the Chornobyl NPP facilities.
Activation of the Crisis Center
The Internal Crisis Center will be activated upon announcement at ChNPP on a site
accident, industrial accident or communal accident.
The Crisis Center is considered as activated after arrival of assigned emergency
personnel and under condition of preparedness of the systems and equipment of crisis
centers to ensure support of functions assigned to the Crisis Center personnel.
The SEWM is a person making decisions on activation of crisis centers.
Identification of an accident shall be performed on the basis of the following:− Readings of measurement devices, alarm devices, technological process control
systems of units and ChNPP;− Results of radiation technological monitoring of protective barriers state andradionuclide content in technological media;− Results of radiation dosimetry monitoring;− Results of individual dosimetry monitoring;− Results of environment radiation monitoring;− Information about damage of fuel assemblies during performance oftransportation and handling operations with fuel;− Information from the personnel on explosions in premises and at industrial sites,
leakages, ruptures and deformations of pipelines and on other visible signs ofdamage of equipment, buildings and structures of the ChNPP;− Information on erroneous actions of personnel, on failures of equipment;− Signals of automated fire alarm system, information of the personnel on smokeand fires in premises and at the ChNPP facilities;− Information on hazard of extreme nature phenomena (tornado, flooding,earthquake, etc.);− Information on theft of ionizing radiation sources;− Information on terrorist acts on the ChNPP facilities;− Information on other unforeseen events, during which non-clarified or significant
decrease of the ChNPP facilities safety level occurs.
Survivability of the MCR, central control room, Crisis Centers and other premises ofobligatory personnel presence shall be ensured by redundancy of power supply control
systems of pumps, communication, as well as by availability of emergency lighting,ventilation systems.
Two protective structures are located at the ChNPP site area:− Protective Structure No 1 under administrative building-1;
119

STATE NUCLEAR REGULATORY INSPECTORATE OF UKRAINENATIONAL REPORT ON STRESS TEST RESULTS− Protective Structure No 2 under administrative building-2.
Protective Structure No. 1 (on-site crisis center) is designed for 1500 persons and isprovided with the following:− double-system ventilation;− power supply (power grid and DG);
− drinking and service water inventory;− autonomous fire extinguishing system;− individual protection equipment, devices for radiation survey and dosimetry
monitoring, medicines.
Protective Structure No 2. is designed for 1500 persons and is provided with the following:− double-system ventilation;− power supply (power grid and DG);
− drinking and service water inventory;− autonomous fire extinguishing system;− individual protection equipment, devices of radiation survey and dosimetry
monitoring, medicines.
The ChNPP personnel’s duties include immediate notification of the Plant Shift Supervisor(PSS) on arising of conditions, which may lead to an accident. Visual observation of visible
signs of an accident (water leakage, open fire, deformations and damage of equipment,
building structures, contortion or rupture of pipelines, strange noises, etc.) is one of the main
ways to reveal an accident along with monitoring using instrumentation and monitoring
systems.
The ChNPP personnel are forbidden to take any independent actions for liquidation of an
accident conditions not foreseen by the ChNPP instructions in force without notification of the
ChNPP PSS and without knowledge of radiation situation.
Assembly of the ChNPP emergency groups and teams shall be announced immediately
after implementation of the Plan.
In case of impossibility to transport the emergency groups’ personnel from Slavutych to
the ChNPP by electric trains, the Transportation Shop shall ensure transportation by motor
vehicles.
The Emergency Work Manager at the ChNPP industrial sites gathers emergency teams:− during working time – in 20 minutes after notification signal “Gathering ofmanagement”;− during off-time – in 30 minutes after notification (at the boarding place of the dutybus of the Transportation Shop in front of the Bus Station of Slavutych).
A representative of Slavutich Medical Sanitary Station-5 shall inform the SEWM
Headquarters about the time of his/her arrival.
Assembly of emergency groups and teams shall be performed after the signal “Assembly
announced for emergency teams, groups and management”:− during work time – after notification in the places of assembly of emergencygroups and teams, near the places of storage of the emergency set, Attachment
16, 17 of the Plan Part III;− during off-time – the bus stop in front of the Bus Station of Slavutych.
Time of getting ready for actions of emergency groups and teams:− during work time – not more than in 0.5 hour after the notification;− during off-time – not more than in 5 hours after the notification.
In case of decrease in the cooling pool level (Stage I) below the level controlled using
regular level indicators and impossibility of visual monitoring (because of radiation factors orother hazardous factors), it is possible to control safe operation limit by the cooling pool levelby absence of disruption of 1,2NV-1(2). For this purpose, it is necessary to assemble thecircuit for cooling of the affected cooing pool and to control stability of its operation
120

STATE NUCLEAR REGULATORY INSPECTORATE OF UKRAINENATIONAL REPORT ON STRESS TEST RESULTS

periodically by short-term (not less than 1 min.) turning-on of the pump and monitor stabilityof its operation.
For Stage I, operation stability of 1,NV-1(2) indicates that the level in the cooling pool is
not lower than the safe operation limit and, consequently, that there is no emergency.
For Stage II, operation stability of 3NB-1(2) indicates that the level in the cooling pool
3CP-1(2) is not lower than the cooling water intake piping, elevation 33.6 m.
The level in SFAP and FCP (Stage I) may be identified using regular manometers of SVO2 (for this purpose, it is necessary to connect SVO-2 to the affected pool), or by readings ofmanometers on pumps 1,2NO-1(2), taking into account levels of their location.
For more accurate identification, it is necessary to replace the regular manometer with the
one graduated in meters with measurement range of 0÷4 kgf/cm2.
The level in FCP of Stage II using the manometer on the treatment line may be
determined only for ЗFCP-1, because ЗFCP-2 has a hydraulic lock on the water intake piping
for treatment.
If decrease of level in Stage II cooling pools is caused by failure of all makeup systems, it
is possible to perform makeup of 1,2 CP-1,2 and 1FCP using water inventory in 2FCP (~160m3). For this purpose, it is necessary to assemble the circuit for treatment of 2FCP, turn on
2NO-1(2) and open valves for return from treatment into the required pool.
Filling of the cooling pool with nuclear fuel after its full emptying should be performed inaccordance with a separate program with indication of measures for nuclear and radiation
safety.
Fission products released from the damaged fuel assemblies into CP water or into unit air
present the main radiation hazard under absence of CP level monitoring. If there areindications of damage of SFA boxes, as a preventive protective measure, it is expedient tostart cooling pool treatment with connection of the ion-exchange part of SVO-2 (SVO-6 forStage II) until pump failure, even in case lining leakage is detected.
The operator has a well-developed emergency response system to prevent stored fueldamage. However, if under subsequent loss of safety functions development of an accident
reaches fuel damage phase, the operator implements the following measures:− Continuation of spent fuel cooling and creation of heat removal conditions using
regular, restored or survived systems of units and storage facilities, as well as“mobile” pipes (fire hoses, hoses, polyvinyl chloride pipes), pumps, MDGPUs.
− Existing Stage II DG have fuel inventory in amount of 75.6 t, which ensuresautonomy during 3.5 days of two DG operation. Operation of one DG to powerpumps will allow ensuring independent power supply (as well as heat removalfrom spent fuel the NF site) during more than 7 days.
− Permanent monitoring of neutron rate and gas-aerosol activity in places of spent
fuel accumulation is performed for monitoring of nuclear safety. Ensure
gadolinium makeup into the damaged CP in case of an emergency caused by
SFA accumulation due to collapse of FCP consoles.
On 15 September 2011, the operator along with the Ministry of Emergencies conducted afull-scale exercise in accordance with the approved program. The ChNPP emergency
preparedness was checked during the exercise. The exercise was performed on the basis of
the approved action plan for targeted safety assessment and further safety improvement of
ChNPP units 1, 2, 3 and ISF-1 to lean lessons from the Fukushima-1 NPP. The Chornobyl
NPP personnel achieved the objectives and tasks of the exercise. Evacuation of 2000
persons to the Semikhody checkpoint and their boarding into railway transport took 1 hour 15
minutes. Measures for improvement of the Chornobyl NPP emergency preparedness system
will be developed on the basis of the exercise results.
There is no risk of steam-zirconium reaction for the ChNPP (for other NPPs, the risk
exists). A steam-zirconium reaction is not achievable, because the temperature of zirconium
121

STATE NUCLEAR REGULATORY INSPECTORATE OF UKRAINENATIONAL REPORT ON STRESS TEST RESULTS

should be not less than 1200°C (all water will evap orate by that moment) to start it. Radiolytichydrogen is generated during “wet” storage of spent nuclear fuel. The main factors
determining conditions for formation of explosive gas mixture on hydrogen basis are amountof stored spent fuel, water volume and air volume within in spent fuel storage place. The
calculation of rate and volume of generated radiolytic hydrogen was performed for the mosthazardous facility, which is the ISF-1. The amount of stored spent fuel at the unit is 12 times
less and the volume of air space over spent fuel is 6 times higher than in the ISF-1. Durationof idle state of the ventilation system, at which achievement of the lower limit of hydrogen
explosive concentration in the ISF-1 is possible constitutes ~10.3 days. Thus, acceptablereasonable ventilation system downtime is not more than 10 days.
6.2 Ch Accident Management Measures to Restrict the Radioactive Releases
Accident Management Measures in Place at the Various Stages of a Scenario of
Loss of the Core Cooling Function
For Units 1, 2, 3, ISF-1 the main measure to restrict releases is restoration of the rated
level in the FCPs, assurance of special ventilation operation at units and possibility toconnect additional filtering cells the ISF-1.
Measures on maintenance of water level in the cooling pool and prevention of uncoveringof spent fuel upper part are considered in Section 5.2.3 and 5.3.3.

7 Ch GENERAL CONCLUSIONS
7.1 Ch Key Provisions Enhancing Robustness (already implemented)
7.1.1 Ch Robustness of ChNPP Units 1, 2, 3 and ISF-1 against External Hazards
Such as Earthquakes, Hurricanes, Floods, External Fires, Extremely Low andHigh Temperatures
Category 1 structures ensuring nuclear and radiation safety of ChNPP units 1-3 and ISF-1
comply with the design documents and are capable of withstanding external hazards
including MCE with intensity of 6 and F 1.5 tornado.
Mutual redundancy (interfaces) of the ChNPP for power supply, fire and service watersupply and makeup are ensured to maintain (or restore the possibility to maintain) safetyfunctions in case of design-basis accidents caused by extreme natural impacts at units 1-3
and ISF-1.
The system for collection and return of leakages from under the ISF-1 cooling pool lining
and maintenance of the acceptable water level in the CP under any design-basis accidents
was upgraded at ISF-1. The upgraded system will allow collection, treatment and return of
ISF-1 CP leakages during design-basis accidents with loss of integrity of CP lining.
Implementation of this measure will sufficiently increase the time for removal of CP
compartments for repair due to loss of integrity.
7.1.2 Ch Assurance of Nuclear Fuel Safety under Loss of Power and Ultimate
Heat Sink
Nuclear safety of spent fuel storage within ISF-1 CP compartments in normal operation,
operational occurrences and design-basis accidents is ensured.
All spent nuclear fuel on-site is cooled for more than 10 years. The nuclear physicalproperties of spent fuel storage places are such that boundary effects (spent fuel heating to
300°C with possible loss of spent fuel integrity) i n case of loss of safety functions resulting in
absence of water in CP do not emerge for a long time (about 2 months).
After loss of the ultimate heat sink (absence of water cooling in CP), it is evaluated thatwater in CP is heated to temperature not higher than 70°C with the largest amount of stored
spent fuel (ISF-1).
The following estimations of hydrogen concentration increase within ISF-1 were obtainedfor failure of the ventilation system:
122

STATE NUCLEAR REGULATORY INSPECTORATE OF UKRAINENATIONAL REPORT ON STRESS TEST RESULTS− design one with conservative suggestion – the lower limit of explosive
concentration of 4% will be achieved in 10 days;− experimental one – 0.2% equilibrium concentration of hydrogen in 20 hours,
which does not increase.
The time of restoration of ChNPP power supply, upon integrity of the infrastructure, is not
more than 2 hours. Upon damage to the infrastructure, the time of delivery of power supply tothe systems ensuring maintenance of the level in the ISF-1 CP and operation of the ISF-1
ventilation systems is not more than 8 hours.
In terms of conservatism, the time for restoration of heat removal from spent nuclear fuelis not less than the time of restoration of power supply to the systems ensuring CP feeding
and is not more than 8 hours. The systems of water supply to CP can be restored in 30
minutes by directing ISF-1 CP leakages to CP compartments without purification (“small
circuit”).
Autonomous operation of DGs for ensuring heat removal from spent fuel during more than
7 days is ensured.
7.1.3 Ch

Measures on Management of Accidents with Severe Consequences

The Chornobyl NPP possesses the system of emergency preparedness and response
ensuring mobilization of the main and additional forces and equipment.
It is proposed to use symptom-based instructions focused on implementation of
preventive measures along with event-based emergency instructions. Such an approach willallow defining actions of personnel at the early stage of accident development, when data
allowing to evaluate the accident development and to reveal its cause are absent, but there
is information necessary to make decisions allowing confining or reducing the accident
consequences.
The Chernobyl NPP takes measures to connect a mobile DG to ISF-1. This technicalmeasure significantly enhances the operator capabilities to manage accidents with severe
consequences.
Organizational technical measures ensuring the return of CP leakages without purification(“small circuit”) in case of destruction of external service lines are performed for ISF-1.
Analysis of management of accidents with severe consequences shows that reduction of
the number of nuclear facilities will allow more efficient use of available resources, bothhuman and technical ones.
7.2 Ch Safety Issues
Earthquake and Tornado
For the ChNPP site, extreme natural phenomena such as extreme wind, snow,
temperature, precipitation, floods and external fire are much less dangerous than earthquakeor tornado. For this reason, the operator within this targeted safety assessment considers anearthquake and tornado as an initiating event resulting in loss of safety functions (power
supply and heat removal).
As of today, the operator has not performed:− analysis of safety margins of nuclear facility structures under earthquakes higher
than MCE;− analysis of safety margins and possibility of CP lining failures (primarily ISF-1)
under MCE and higher impacts;− seismic assessment of equipment and service lines (e.g., CP cooing and level
control);− resistance analysis of ChNPP category I structures, possible failures of structures
upon F 3.0 tornado.
However, it should be mentioned that the above measures are envisaged within the safety
improvement plan of the ChNPP.
123

STATE NUCLEAR REGULATORY INSPECTORATE OF UKRAINENATIONAL REPORT ON STRESS TEST RESULTS

External Floods (as a result of accidents at hydro and technical structures)
ChNPP resistance has been confirmed. Safety deficiencies have not been revealed.
Other Natural Effects (external fires; extremely high/low temperatures; extreme wind;extreme snow; combination of external extreme effects)
ChNPP resistance has been confirmed. Safety deficiencies have not been revealed.
Loss of power supply and/or heat removal for ultimate sink
Loss of power supply to units 1, 2, 3 and ISF-1 does cause accidents with damage of
nuclear fuel. Designs of nuclear facilities envisage power supply backup, and layout andinter-unit communications ensure high reliability of the systems powering the nuclear
facilities. Along with this, the characteristics of stored spent fuel are such that hydrogensafety is ensured and there is a sufficient time reserve to restore the safety functions lost
during an accident.
Management of severe accidents
The Chornobyl NPP possesses the emergency preparedness and response system,
which ensures mobilization of the main and additional forces and means. The ChNPP safety
improvement plan includes measures to improve emergency preparedness and response.
7.3 Ch Potential Safety Improvements and Further Work Forecasted
The measures to improve resistance of nuclear facilities to external hazards, ensure
safety of nuclear facilities in loss of power and/or ultimate heat removal, as well as additional
measures to manage accidents and mitigate their consequences are specified in the “Safety
Improvement Plan for ChNPP Nuclear Installations” agreed with the State Nuclear
Regulatory Inspectorate of Ukraine.
In particular, the ChNPP Safety Improvement Plan includes the following measures:
research for structures of category I responsibility for nuclear and radiation safety toidentify a strength margin and probability of a failure under a tornado of class 3.0 andunder seismic impact;- research of seismic resistance of the ISF-1 cooling pool lining;- analysis of durability and probable failure of ventilation stack-1 under seismic impacts
and tornadoes;- justifying calculations for the maximum temperature of SFAs taking into accountprobable radiation consequences at SFA “wet” storage;- development of an Action Plan for Improvement of the Emergency Preparedness
System for the cases of beyond design accidents caused by extreme hazards,
including actions for emergency response at the scenario with a building collapse and
CP depressurization;- development of actions for fast transportation of emergency brigades from the Slavutich
town by alternative ways in case of Slavutich-ChNPP railway disability due to an
earthquake;- reconstruction of radiation monitoring system;- development of actions to restore operability of equipment ensuring the spent fuel onsite transportation damaged in case of an earthquake and tornado;- procurement of a new car-cask for spent fuel transportation;- improvement of the personnel training program under emergencies.
-

The ChNPP nuclear facilities were provided with a mobile diesel generator in November
2011.

124